Speaker 1: Special Operations, Cobert SB.
Speaker 2: And I.
Speaker 1: The team House with your hosts Jack Murphy and David Park.
Speaker 3: Hey, folks, I'm Jack Murphy here with Dave Park. You
Speaker 3: will see him over there or on the wide shot.
Speaker 3: He looks a little lonely today because things are different.
Speaker 3: Dimitri had some car problems, so I am back in
Speaker 3: the production chair after like two three years since I've
Speaker 3: done this last so apologies if there's any technical issues.
Speaker 3: Our guest tonight is Deviant Olum. Deviant has a background
Speaker 3: in pen testing, red teaming, and physical security.
Speaker 4: A few years ago, Dave and I.
Speaker 3: Took a class of his at Defcon where he taught
Speaker 3: kem uh. He had a whole class about cracking safes
Speaker 3: and he also has a lot of information, interesting details
Speaker 3: about the history of intelligence services cracking into safes and
Speaker 3: how they went about that. So we're going to talk
Speaker 3: about all this stuff tonight. Uh, mister Deviant, thank you
Speaker 3: for joining us.
Speaker 2: Thanks so much for having me. This is exciting, glad
Speaker 2: to be here.
Speaker 4: Yeah, I've been a fan of yours for a long time.
Speaker 4: Can for viewers who might not know, because this is
Speaker 4: exciting stuff like this is movie stuff, and for people
Speaker 4: who might not know what pen testing is or physical
Speaker 4: pen testing like you are. You know, you're you're the
Speaker 4: analog Barbie in a digital world, right, but you're the
Speaker 4: guy on the ground. Can you tell us what pen
Speaker 4: testing and red teaming is and particularly in your world?
Speaker 2: Sure thing?
Speaker 5: So perhaps the you know, the the boardroom technical language
Speaker 5: that we sanitize things with, we say it's adversarial emulation.
Speaker 5: Or if you want to sound cool, just at a
Speaker 5: cocktail party with your friends. My wife just says, I'm
Speaker 5: professionally dangerous. The movie style reference that you make. If
Speaker 5: some of the folk of the audiences are old enough
Speaker 5: to remember a film in the early nineties, Robert Redford,
Speaker 5: dan akro David Strether and another's city Poier Lake River, Phoenix.
Speaker 5: It was called Sneakers. That's one of the best illustrations.
Speaker 5: In fact, I know the technical advice on that film.
Speaker 5: Who's in the trades?
Speaker 2: Right?
Speaker 5: That is what we do. We break into places so
Speaker 5: that people can find out how secure their place is.
Speaker 5: We pick the locks, we bypassed the alarms, we mess
Speaker 5: with all the access control systems. Case sometimes I'm cracking
Speaker 5: safes and the customer gets to find out could a
Speaker 5: bad guy with a given sort of threat profile, get in,
Speaker 5: get out, possibly do so unnoticed, and then we can
Speaker 5: help advise them or their colleagues and their contacts of
Speaker 5: what mitigation steps they might want to take to change
Speaker 5: to change how robust their security is now.
Speaker 4: Is it always mission and pop coming down from the
Speaker 4: skylight or do sometimes? You know? And I'm as asking
Speaker 4: because I know because I've seen your videos and if
Speaker 4: you guys have not checked out any of his videos
Speaker 4: on YouTube, you owe it to yourself. They're all fascinating.
Speaker 4: But sometimes as it is easy as picking up a clipboard.
Speaker 2: Yeah, I mean it is.
Speaker 5: You like to fantasize and say that we're all wearing
Speaker 5: the you know, the black and you have the tactical
Speaker 5: rope gear and your climate.
Speaker 2: But yeah, it's sometimes it's one step above knock knock,
Speaker 2: knock a password inspector, you know, sometimes you just show up.
Speaker 5: When you think about though, I actually think that's not
Speaker 5: a bad thing. I think it's representative of how trusting
Speaker 5: and safe much of our world is. A lot of
Speaker 5: people don't have a high that they live under. Alleople,
Speaker 5: if she shows up and they have to stay the
Speaker 5: affilicking clip or they've got some paperwork from the local.
Speaker 2: Media, Pappy, and they say, hey, yeah, we're the meter
Speaker 2: readings today. Who's your facilities director? Oh he's out at lunch.
Speaker 2: Well yeah, he usually just gives me a key. A
Speaker 2: lot of people working at a front desk if nothing
Speaker 2: gets there ackled up.
Speaker 5: Oh well that's that makes sense to me. This person
Speaker 5: doesn't seem like they're behaving like a threat. Yeah, the
Speaker 5: water meter back there in the utility closet. You need
Speaker 5: to show you the way. That's a lot of things
Speaker 5: just get done in our world. And if you've ever,
Speaker 5: for example, had a hotel and maybe the room wasn't
Speaker 5: under your name, you're staying with a colleague or a spouse,
Speaker 5: and you say, oh, I left something in the room,
Speaker 5: most hotels shouldn't give you a key without verifying with
Speaker 5: your name's not on the room. But there's plenty of
Speaker 5: places out there where if you're not behaving squirrely, and
Speaker 5: you can say, yeah, you know who was at the
Speaker 5: desk earlier.
Speaker 2: It was a blonde girl, right, it was Judy. Yeah,
Speaker 2: she was checking us like, well, you know, Judy, you
Speaker 2: were here.
Speaker 5: You don't look like you're a methad about to steal
Speaker 5: the television. Yeah, what room did you need again?
Speaker 2: Boom?
Speaker 5: Our world has a lot of places where we reduce
Speaker 5: friction by doing a quick mental calculus and saying, yeah,
Speaker 5: that this person, you know, kind of that that Gavin
Speaker 5: de beck a gift of fear.
Speaker 2: You're not the hairs in your neck aren't rising.
Speaker 5: So much of what we do is, as you describe,
Speaker 5: just look like we belong there, have a cover story
Speaker 5: that's plausible, and that'll do it.
Speaker 2: Sometimes you don't have to break out the special high
Speaker 2: tech tools.
Speaker 4: Yeah, so let's roll back and start from the beginning.
Speaker 4: We always like to ask our guests their origin story,
Speaker 4: like how did you get your superpowers? Or TV? So
Speaker 4: you you know, you're in a very unique world, you know,
Speaker 4: and this isn't you know. Usually we think of people
Speaker 4: who are in this world either got there by way
Speaker 4: of being with the government or against it. Right, either
Speaker 4: you know, a criminal or or you know some sort
Speaker 4: of you know, be any section of law enforcement or
Speaker 4: intelligence or whatever. How did you grow up and what
Speaker 4: led you into this?
Speaker 5: Yeah, the the tongue in cheek answer that we like
Speaker 5: to s sometimes says that I had some of the
Speaker 5: right friends and some of the wrong friends.
Speaker 2: And the more broad answer is.
Speaker 5: That I had a healthy curiosity about the world around me.
Speaker 5: I didn't take a lot of things at face value.
Speaker 5: I was raised to question a lot of things by
Speaker 5: my loving and kind parents. And when you have that
Speaker 5: kind of mental disposition, and you're fortunate enough to grow
Speaker 5: up in an environment where I don't know if kids
Speaker 5: today could could grow up the way I did.
Speaker 2: You know, people our age, your age, my age, like, we.
Speaker 5: Snuck around, We got into place so we shouldn't have been,
Speaker 5: And there weren't just people ready to call the cops
Speaker 5: the instant they saw a teenager, you know, in that's
Speaker 5: you know what, why is he on that side of
Speaker 5: that fence.
Speaker 2: We were allowed to kind of explore and it was
Speaker 2: lower stakes and doing so, you yeah, you kind of
Speaker 2: learned how you could get in and out of abandoned
Speaker 2: buildings and things like that.
Speaker 5: And having that knowledge it never really left me. It
Speaker 5: never went away. It was always in the back of
Speaker 5: my mind. If I was staying at a hotel as
Speaker 5: a teenager, or you know, in my twenties, I was
Speaker 5: always trying to well, which doors go to the back
Speaker 5: of house, which go to the maintenance spaces?
Speaker 2: I went oh, oh, there's pipes, there's a generator. This
Speaker 2: is I'm not supposed to be here. And then you
Speaker 2: get a little bit older and you're staying in hotels
Speaker 2: or visiting big buildings. You say, I wonder if I
Speaker 2: can get on the roof.
Speaker 5: I wonder if I can get into, you know, something
Speaker 5: that's more critical infrastructure, and you start to realize that
Speaker 5: a lot of the systems that control our world, especially
Speaker 5: access control systems, rely on things like doors that swing
Speaker 5: shut and click properly, and they often don't, or you
Speaker 5: rely on things like, well, no one would want to
Speaker 5: go back there because you know, why would you ever
Speaker 5: do There's no sign on the door saying it's valuable.
Speaker 2: Who would ever check that door?
Speaker 5: And you start being the person who checks all the doors,
Speaker 5: and then eventually you say, wow, I can get in
Speaker 5: a lot of places that our world things you can't
Speaker 5: get into. I wonder if I could ever do anything
Speaker 5: with this, And I'm fortunate enough that I actually got to.
Speaker 5: It's not an easy career to find yourself in. It's
Speaker 5: what a lot of people turn to us for kind
Speaker 5: of a fish training, which nowadays training is two things.
Speaker 5: A lot of people like to say training and certifications.
Speaker 5: You know what's the value in that, And it's twofold.
Speaker 5: One is learning skills, but also just kind of getting
Speaker 5: that official blessing that.
Speaker 2: Says, well, I'm not just some chump. I'm not just.
Speaker 5: Somebody who's a criminal. I've actually tried to better myself.
Speaker 5: I've done some of this professionally. Is if you want
Speaker 5: to become a bouncer, maybe you're a guy who's just
Speaker 5: good at fistfighting, but maybe if you actually went to
Speaker 5: a training course, they say, oh, all right, the training
Speaker 5: isn't just me. Anybody could hit somebody. You actually can
Speaker 5: keep your head about you. You can do things with
Speaker 5: best practices. You understand the professional way to go about
Speaker 5: what otherwise would be a very blunt sort of trade.
Speaker 5: And that's why, Yeah, people come to us all the
Speaker 5: time at Red Team Alliance because they say, I want
Speaker 5: to do what you do, but I want to do
Speaker 5: it properly. And a lot of people have the knack,
Speaker 5: or at least the desire to get in places they
Speaker 5: shouldn't be, But can you do it in a way
Speaker 5: that is respectful and responsible and adds value to the
Speaker 5: claw clients who are paying you to do it?
Speaker 2: That's that's a different the street criminal.
Speaker 4: You know, it's interesting too because you know, like I said,
Speaker 4: you are analog in a digital world in this sense
Speaker 4: of you're a hacker. You know, you're uh, you know,
Speaker 4: a feature at doufcon and at all the you know,
Speaker 4: different hacking conventions, and your path was it seems to
Speaker 4: me that it was probably very parallel to a lot
Speaker 4: of how the OG hackers grew up, where they were
Speaker 4: doing things that you know, weren't probably just because there
Speaker 4: weren't you know that you didn't have training facilities, you
Speaker 4: didn't have Hacked the Box, you didn't have these things.
Speaker 4: People just learned it by doing it, and and so
Speaker 4: you were. You were on that exact same path, only
Speaker 4: where they were breaking into systems, you were breaking into buildings.
Speaker 2: Yeah, that's absolutely the case.
Speaker 5: And I'm very as I say, I'm very concerned that
Speaker 5: we don't give a lot of younger minds these days
Speaker 5: the space and the room to run. I like that
Speaker 5: you called out things like hack the Box and so forth.
Speaker 5: Those those resources and those assets are really important now
Speaker 5: because we don't live in a world that is as
Speaker 5: forgiving as it once was. Right, and these minds need
Speaker 5: a place to grow and experience these challenges and try
Speaker 5: out their skills in real world sort of sort of
Speaker 5: play environments.
Speaker 2: Otherwise, if all you're doing.
Speaker 5: Is prepackaged, you know, kind of buy the book lessons,
Speaker 5: are you really learning how things work out there.
Speaker 4: On a job? Right?
Speaker 3: So?
Speaker 6: How?
Speaker 4: Because I have to know how did you make that transition?
Speaker 4: Because where with the digital side and with hackers, we
Speaker 4: see you know the development of software companies and software
Speaker 4: and you know the and then you know countermeasures you
Speaker 4: know to hackers and stuff like that. But for you,
Speaker 4: how did you plant a flag and say hey, I
Speaker 4: can break into a building? Anybody want that?
Speaker 2: All the credit there?
Speaker 5: I think I would keep on a longtime friend of
Speaker 5: mine who's in town because we're in town for black
Speaker 5: Hat and Defcon. Of course, so my buddy Jeff the
Speaker 5: Dark Tangent, who started def Con and with it black
Speaker 5: Hat some years after def Con was around the black
Speaker 5: Hat conference, which I don't know if all your listeners
Speaker 5: know the full origins, I'll give you the real quick story.
Speaker 2: It's a brilliant hack of its own type.
Speaker 5: The origins of black Hat, the conference and trade show
Speaker 5: def Con, which originally started as just kind of a
Speaker 5: going away party for Jeff's bulletin board that he was running.
Speaker 2: People said, oh, man, this is so cool.
Speaker 5: I came out to Vegas and you had this big
Speaker 5: party and there were these talks are you going to
Speaker 5: do this again? You got to do this next year?
Speaker 5: This was great and he's I wasn't playing on anything
Speaker 5: like that. I just kind of threw something together from
Speaker 5: my friends.
Speaker 2: If you want to, we'll do it.
Speaker 5: So then def Con happened next year, and def Con
Speaker 5: happened the year after that, and Defcon the con friends
Speaker 5: kept growing and people were coming up to Jeff in
Speaker 5: the hacker world and saying, man, oh, you're a dark tangent.
Speaker 5: You run that deaf Con thing. That's so cool, man.
Speaker 5: I wish I could go to that. And he would say, then,
Speaker 5: then do it. It's a fifty dollars conference. Why don't
Speaker 5: you just come? He said, no, my company would never
Speaker 5: send me that.
Speaker 2: Why.
Speaker 5: He's like, well, you know, like you said, it's a
Speaker 5: fifty dollars conference. It's not professional. It's you know, it's
Speaker 5: not My boss would laugh me out of the room.
Speaker 5: And Jeff looked at these people and he said, you're
Speaker 5: telling me that I'm running an event that is accessible,
Speaker 5: has great content, has great speakers, has all the information
Speaker 5: you need, and you can't come because it's too cheap.
Speaker 5: And they said basically, yeah, So the very first year
Speaker 5: that black Cats started, and Jeff would tell the story
Speaker 5: with a little more detail, but effectively, he reached out
Speaker 5: to his most popular speakers, the ones who were already.
Speaker 2: Coming to Deafcon, and he said, Hey, do me a favor.
Speaker 5: I want you to come into town almost a week early,
Speaker 5: and I want to put you up at the Caesars
Speaker 5: and I want.
Speaker 2: You to give the same talks you're gonna give it
Speaker 2: at def Con. Give them a few.
Speaker 5: Days early to like Feds and suit wearing people and stuff,
Speaker 5: and we're going to charge twelve hundred dollars at the door.
Speaker 2: We're going to call it black Hat. And everyone thought
Speaker 2: that was nuts.
Speaker 5: And all those companies that people their bosses wouldn't let
Speaker 5: them come to def Con. They said, now this is thing,
Speaker 5: the black Cat thing. You bring me this pamphlet, this
Speaker 5: is what you should be going to thanks. This is
Speaker 5: serious business, right and you know it's the same. It
Speaker 5: was the same thing for the first few years, and
Speaker 5: then of course black Hat developed professional trainings, multi day trainings,
Speaker 5: and I've been going to def Con and black Hat
Speaker 5: for ages.
Speaker 2: Now I've been going to sayce Defcon eight and good lord,
Speaker 2: it's what is it, def Con thirty three thirty four?
Speaker 2: Oh my good lord. But when the trainings were starting,
Speaker 2: you know, people just hey, you're.
Speaker 5: Good at this thing. You should run a training. It
Speaker 5: wasn't these full on massive training works. And Jeff approached me.
Speaker 5: Tangent said, hey, man, you've been given lock picking talks
Speaker 5: at def Con. People love that lock pick stuff you do.
Speaker 5: You know you should run a training, black Hat And
Speaker 5: I was like, get the hell out of here. No
Speaker 5: one's going to come learn lock picking from me for
Speaker 5: two days. That's insane. I just do it for free
Speaker 5: at Defcongus.
Speaker 2: I love it.
Speaker 5: And he said, no, you should do it, man, We're
Speaker 5: going to pack that room. And that was my first
Speaker 5: professional training that I gave. This is long before Red
Speaker 5: Team Alliance or anything that existed. It was just me
Speaker 5: and my buddy Bobbic in a room and sure enough
Speaker 5: we were teaching people the basics.
Speaker 2: And next year they said, oh, you should electronics. You
Speaker 2: u talk about alarms.
Speaker 5: She used to talk about this, and we just kept
Speaker 5: adding content, and as often happens at Black Hat, many
Speaker 5: times people will take a whole training and they'll say,
Speaker 5: this is great stuff.
Speaker 2: I learned a lot. Can I hire you to do this?
Speaker 5: And you look at them at the end of two
Speaker 5: days and you say, you just paid to learn how
Speaker 5: to do it though, and they said, yeah, but my
Speaker 5: company wouldn't believe me. I'm internal if I report all
Speaker 5: these findings that we really need an external voice to
Speaker 5: validate all these findings.
Speaker 2: Can we just hire you guys? It's like money can
Speaker 2: be exchanged for goods and services. I don't mind having
Speaker 2: no money. Sure.
Speaker 5: So that's where some of our earliest clients came from.
Speaker 5: They were the people we were training at Black Cat
Speaker 5: who were then immediately a month later hiring us to
Speaker 5: come break into their buildings, and then word of mouth spread.
Speaker 2: We've never done any real marketing of any kind.
Speaker 5: It's just people. Oh, those are the guys who do
Speaker 5: that stuff. Yeah, I've heard of that that you should.
Speaker 2: Take their training, you should hire them, did that thing,
Speaker 2: And that's that's how I got my career.
Speaker 4: Well, you know, now, I guess when you know we
Speaker 4: think of red teaming and you know, getting access to
Speaker 4: internal you know systems and whatnot, like the physical red
Speaker 4: teaming and the physical pen testing. You know, we think
Speaker 4: of that. But how did you you know, before the Internet,
Speaker 4: before all this, you know, was it twenty six how
Speaker 4: did you find yourself in the you know, with this
Speaker 4: set of skills in the hacker community.
Speaker 2: Yeah, so you mentioned briefly.
Speaker 5: I hired a little passing reference to twenty six hundred,
Speaker 5: the magazine, the twenty six hundred meetups.
Speaker 2: I was part of the twenty six hundred crew.
Speaker 5: Back easton Philly where I was living, there was a
Speaker 5: non pro well now is a nonprofit. At the time,
Speaker 5: it was just kind of a ragtag group of enthusiasts.
Speaker 5: There's this group called TOOL, the Open Organization of Lock Pickers.
Speaker 5: That is a group that still exists to this day.
Speaker 5: I was on their board of directors as a nonprofit
Speaker 5: board member for a very long time. But it was
Speaker 5: people just kind of had a passing enemprist. Or you
Speaker 5: would be at a tech even a professional tech event,
Speaker 5: you might see somebody picking locks just as a hobby,
Speaker 5: much in the way that you'll see people nowadays cross
Speaker 5: stitching or doing crochet. If they're on a long plane
Speaker 5: flight or sitting in a long lecture in an academic setting,
Speaker 5: you'd see locks being picked in the hacker world, and
Speaker 5: for some people that never went anywhere beyond being a
Speaker 5: hobby and for some of us became a real obsession.
Speaker 5: But yeah, the hobbyist community and that the hacker mindset
Speaker 5: of these are some cool skills. I just want to
Speaker 5: use them for fun. Fun can become profitable.
Speaker 4: I would like to thank a sponsor tonight, somebody I'm
Speaker 4: actually I've never heard of, but I'm super excited about
Speaker 4: right now. You see, I have to put on my
Speaker 4: reading glasses of getting old and with that age and
Speaker 4: the abuse that Jack and I have been through through
Speaker 4: the years, the arthritis, the sleep at NEEA, the insomnia.
Speaker 4: You know, this amounts of scotch, Yes, copious amounts of scotch.
Speaker 4: You know, we had Chris free On just a short
Speaker 4: while ago and he talked about the operator syndrome, right,
Speaker 4: and you know we have TVIS and blast exposure and
Speaker 4: post traumatic stress and all these things going on for
Speaker 4: us and and not just us, but everybody. You're all,
Speaker 4: you know, subjected to all this stuff. So our new
Speaker 4: sponsor is superpower dot Com. And the reason I'm really
Speaker 4: excited about Superpower dot Com is a lot of things
Speaker 4: that Chris was talking about, a lot of the processes
Speaker 4: that are going on in our bodies that we don't
Speaker 4: know about, and that like your normal doctor isn't even
Speaker 4: gonna know to check their checking this stuff. It's a
Speaker 4: concierge medical service.
Speaker 2: Uh.
Speaker 4: You know, we've all been there. You go to the doctor,
Speaker 4: get your blood drawn, and a week later you hear
Speaker 4: everything looks fine, And a lot of times you got
Speaker 4: to pull teeth just to get them to do a
Speaker 4: basic panel. Right. Maybe they tell you to drink more
Speaker 4: water or exercise more, but that's it. No breakdown of
Speaker 4: your hormones, no insight to the inflammation, toxins, the nutrient deficiencies,
Speaker 4: just vague advice and a pat on the back. Superpower
Speaker 4: Health is a completely different experience. It's a revolutionary new
Speaker 4: kind of preventative care, more comprehensive, more actual, and you
Speaker 4: can do it all from the comfort of your own home.
Speaker 4: Here's how it works. Twice a year, Superpower sends a
Speaker 4: licensed professional right to your door to collect a comprehensive
Speaker 4: lab panel, or you can visit a nearby lab. Super
Speaker 4: Power measures over one hundred biomarkers. That includes your heart,
Speaker 4: your liver, your thioid, your hormones, your metabolism, your vitamin
Speaker 4: and in your mineral levels. I mean that is like
Speaker 4: everything that Chris was talking about, right, and again, a
Speaker 4: lot of you may not have been in the military
Speaker 4: and may not have had special ops, may not been combat.
Speaker 4: It doesn't matter. Like these stressors, they affect all of us,
Speaker 4: you know, and you know it's just this is amazing
Speaker 4: to me. I just cannot wait to get started with this.
Speaker 4: Then you get a personalized action plan based on your results,
Speaker 4: all beautifully laid out in their app, plus access to
Speaker 4: your own private medical team to help guide you. It's
Speaker 4: the same level of testing and insight the pro athletes get,
Speaker 4: but at a price that actually makes sense. Stop hoping
Speaker 4: you'll live a long, healthy life, start taking action. For
Speaker 4: a limited time, our listeners get fifty dollars off when
Speaker 4: they use Code Team. That's Team Code Team at superpower
Speaker 4: dot com. The superpower not only gives you an initial plan,
Speaker 4: but it attracts your results over your lifetime. Each test
Speaker 4: builds on the last, giving you a full picture of
Speaker 4: your progress year after year. So for a limited time,
Speaker 4: our listeners are getting fifty dollars off an annual Superpower
Speaker 4: membership by using code Team at checkout. Just head to
Speaker 4: superpower dot com and use code team that's team to
Speaker 4: get our exclusive discount, your biology decoded, your blueprint activated
Speaker 4: with Superpower. After you approach, after you purchase, they will
Speaker 4: ask you where you heard about them. Please please support
Speaker 4: our show and tell them our show sent you. Like
Speaker 4: I said, this to me is exciting, like when they
Speaker 4: talk about getting all these tests and you know, all
Speaker 4: these things, I don't.
Speaker 7: Even know where it started, and you have to find
Speaker 7: somebody who will actually do it.
Speaker 3: You also have no idea, like you know, if you're
Speaker 3: having aches and pains or you're feeling tired all the time,
Speaker 3: like you don't know what you're deficient in.
Speaker 4: It it could be a vitamin, it could it could
Speaker 4: be anything, right, yeah, yeah, yeah, So and look, maybe
Speaker 4: you're old and broken like I am, or young and
Speaker 4: spry like Jack. But it's like it's it's always a
Speaker 4: good time to start, you know, either find out what's
Speaker 4: going on or to you know, stay young and healthy
Speaker 4: for the next forty years. So anyway, check them out
Speaker 4: Superpower dot com. Use team to check out thanks. Yeah,
Speaker 4: that's fantastic. What was the first like big score for
Speaker 4: you where you're like, wow, I can actually do this
Speaker 4: for a living.
Speaker 2: I'll answer it in two ways.
Speaker 5: There was the first time that I sort of unofficially
Speaker 5: fell into this work, and then the first really good client.
Speaker 2: And I'll sanitize both of them.
Speaker 5: Obviously, one was a law firm, and this was just
Speaker 5: a local you know, to where I was.
Speaker 2: Living near Philadelphia.
Speaker 5: They were just outside the city and they essentially had
Speaker 5: assists admin there. There guy who was on site. They're
Speaker 5: the guy who did all the computers and servers.
Speaker 2: In the accounts.
Speaker 5: He just kind of rage quit one day, just real
Speaker 5: table flip slammed the door.
Speaker 2: And people are like, I don't know if he's coming back.
Speaker 5: And I was known as a guy who could get
Speaker 5: into locked places just word of mouth. People knew me
Speaker 5: as that person from the hacker community. And somebody knew
Speaker 5: somebody who knew somebody who called me and they said, hey,
Speaker 5: we have a situation here at this law office. We
Speaker 5: kind of think we should be doing something. We had
Speaker 5: this guy leave. We don't know if he has the passwords.
Speaker 5: We need to mitigate this situation. And I was consulting
Speaker 5: at the time, which means I was between jobs, right right,
Speaker 5: And I said, oh, I could make some room in schedule,
Speaker 5: and I'm make my way over there. And I didn't
Speaker 5: know if they wanted me essentially to do any tech
Speaker 5: work or I didn't know exactly what they wanted because
Speaker 5: I thought they said, oh, the door's locked, to get
Speaker 5: a break.
Speaker 2: They didn't expect me to break in.
Speaker 5: They expected me to take over the servers, which you know,
Speaker 5: I did a lot of network security work too, so
Speaker 5: I was there with my copy of nor Dolls and
Speaker 5: Ta boots and other things. But as I showed up,
Speaker 5: I said, it will sit tight. We got a locksmith
Speaker 5: on the way to get you in. As soon as
Speaker 5: you get into that office, you can do your thing
Speaker 5: that we hired you to do.
Speaker 2: And I said okay.
Speaker 5: And I sat there and just I don't know what
Speaker 5: I was doing in the lobby is pre social media.
Speaker 2: I just must have read a magazine.
Speaker 5: So I was bored and I said, you know, I'm sorry,
Speaker 5: I'm a clock. I've been here a while. Now, can
Speaker 5: you show me that what we're we talking about for
Speaker 5: the server room here? And they took me down a
Speaker 5: hall and I went, oh, it's just an office door.
Speaker 5: I'm pretty sure I can bypass that. And sure enough,
Speaker 5: you know, kachunk you slip I you know, took the
Speaker 5: cover off some TPS report equivalent, slip the cover into
Speaker 5: the doorframe.
Speaker 2: Door pops open.
Speaker 5: I was like, all right, well, canceled the locksmith, and
Speaker 5: then I did my thing with all the servers and
Speaker 5: I'm rootbooting and I said, okay, well it looks like, yeah,
Speaker 5: you don't have any Telnet or SSH running your net
Speaker 5: or your mail server. Your web must be hosted elsewhere. Yeah,
Speaker 5: this doesn't look too squarely. Have a proper incident management
Speaker 5: team come through. But you're you're looking pretty good. I
Speaker 5: can change your root passwords. What do you want that
Speaker 5: new password to be? And writing it down? They go, yeah,
Speaker 5: a new root passport.
Speaker 2: Yeah, what did you do to that door?
Speaker 5: I was like, oh, yeah, your door latches aren't activating
Speaker 5: correctly because you have access control latches.
Speaker 2: It's you know, your locksmith could explain that to you.
Speaker 5: He said, no, you explain it to me, show us,
Speaker 5: show us in this guy's office and he's calling partners over.
Speaker 5: So that was the first time that someone said, oh,
Speaker 5: you do more than just the ones and zero's you
Speaker 5: do that break in thing, and that I was known
Speaker 5: just in the local Philly area as a guy who
Speaker 5: could do that, and as far as nationwide. One of
Speaker 5: our first, as I mentioned, you know, students that we had,
Speaker 5: was a crew of students from a we'll just call
Speaker 5: them a major tech company.
Speaker 2: They make internet appliances and internet.
Speaker 5: Services that loads of people have interacted with and they've
Speaker 5: been they're in your data centers. They they're a well
Speaker 5: known brand. And they were the ones that shocked. They
Speaker 5: took us out to dinner. I'd never been to a
Speaker 5: fancy Vegas restaurant. I'm some young kid, and I was
Speaker 5: shocked when they said, we got to get your infhobiues.
Speaker 2: We want to hire you.
Speaker 5: And you know, a few weeks after black Hat, they
Speaker 5: were hiring us to break into multiple offices around the country.
Speaker 5: And you've done this before, right, I broke it into
Speaker 5: a car dealership, in a law office in Philadelphia, some
Speaker 5: other small time stuff.
Speaker 2: Never have anything big like this. Every job you think
Speaker 2: you're like, well, this is gonna be the job.
Speaker 5: There's gonna be a tough one, and then you realize no,
Speaker 5: there's always a way in there's always a way you
Speaker 5: can you can break in, you can.
Speaker 2: Find a way each and then you just get win
Speaker 2: after win after win, and.
Speaker 5: Then and you're the guy. We got to hire those guys.
Speaker 5: Hire that team again. Nowadays, whenever somebody bids a job,
Speaker 5: they tend to reach out. So RTA is our training company,
Speaker 5: but the core group is is who you know are
Speaker 5: breaking consulting firm. And it's funny we always get told
Speaker 5: in these calls, they say, well, yep, we're talking to you,
Speaker 5: because everyone we talked to either said hire the core
Speaker 5: group or those guys trained us, Like they're either they're
Speaker 5: the ones who do it or they're the ones who
Speaker 5: train the people who do it.
Speaker 2: Just just hire them. So the word of mouth just
Speaker 2: keep spreading.
Speaker 4: That's fantastic. I would love to ask.
Speaker 3: I have to ask, has there ever been a situation
Speaker 3: where the bad guys wanted to hire you and like
Speaker 3: you're kind of like does a sketch or I need
Speaker 3: to take a step back from this one.
Speaker 2: You know, for the longest time the answer was no.
Speaker 2: And I'll say there have been two occasions when yeah,
Speaker 2: you got two stories out of me on this one.
Speaker 5: Two occaions were things were a little weird. One was
Speaker 5: a job that we wound up not taking. It was
Speaker 5: going to be in Taiwan. It was going to be
Speaker 5: for a very famous property in Taipei.
Speaker 2: It's it's very big.
Speaker 5: Famous pictures of it on the internet, where if you're
Speaker 5: familiar with what a tuned mass damper is inside of
Speaker 5: big buildings, theirs is a gorgeous you can bet you'd
Speaker 5: almost walk up and touch it.
Speaker 2: It's a very famous building.
Speaker 5: And the whole thing was they wanted to you know,
Speaker 5: they said, well, here we are, Taiwan is a very
Speaker 5: politically sensitive area, and we have a very large neighbor
Speaker 5: and we're not sure if they're interested in, you know,
Speaker 5: our buildings. And we were never actually one hundred percent
Speaker 5: sure if this was people from the Taiwanese authority who
Speaker 5: were worried about China, or if this.
Speaker 2: Was kind of trying to hire us to do something
Speaker 2: in Taiwan.
Speaker 5: I mean, I think it was probably all in the
Speaker 5: up and up, But the job wound.
Speaker 2: Up never coming, you know, kind of coming to fruition.
Speaker 2: I said, you know what, that's probably for the best.
Speaker 2: I'm fine with that.
Speaker 5: The other one was our on the training side at
Speaker 5: R ta. We did have a student. This was very recent.
Speaker 5: We've never we've never had this come up until very recently.
Speaker 5: We've had a student in one of our access control
Speaker 5: classes where I mean, if you don't even the show notes,
Speaker 5: you'll link you see like what our training is very clear.
Speaker 5: It's talking about like I class and room keys and badge.
Speaker 5: Badge cloning and things like that was one of the things.
Speaker 2: And this one person showed up and almost within the
Speaker 2: first hour he started.
Speaker 5: Asking questions about so is this how credit cards work?
Speaker 5: And we're like, well, I mean credit cards, you know,
Speaker 5: like tap to pay, I mean they use NFC, the
Speaker 5: use near field, I mean, it's like RFID kind of
Speaker 5: it is, you know, inductively coupled. But we you know,
Speaker 5: we're talking about badge control systems and you don't. You
Speaker 5: don't use credit cards to get into your data centers, right,
Speaker 5: And he keeps listening and stuff.
Speaker 2: No, but when are we going to do the credit
Speaker 2: card stuff? You know, ISO ISO fourteen.
Speaker 4: Four to four B.
Speaker 2: And we're like, well, what did you just like google what?
Speaker 5: He was asking questions that made it sound like he
Speaker 5: just googled something like card cloning and found us and
Speaker 5: it became apparent that he was literally in class because
Speaker 5: he thought he was going to learn how to clone
Speaker 5: credit cards, and everyone around him, there was a mix
Speaker 5: of like Feds and other people in the room like
Speaker 5: over at him, and he said, it's like the guy
Speaker 5: who walks into the head shop and is like, this
Speaker 5: glass pipe is for the marijuana's right right?
Speaker 3: You know, Yeah, I was gonna I was gonna say,
Speaker 3: it sounds like it sounds like the nine to eleven
Speaker 3: hijackers that want to learn how to fly, but not
Speaker 3: way in the airplane.
Speaker 4: You're kind of like, uh right, yeah.
Speaker 5: And eventually we talked to him during some breaks, and
Speaker 5: he sounded like a guy. He didn't sound like he
Speaker 5: was a criminal. It sounded like he was trying to
Speaker 5: maybe spire and bark on a new career. He just
Speaker 5: didn't quite understand why it was. I think he he
Speaker 5: told a story to us about how a relative of
Speaker 5: his had had a legitimate, like credit card fraud and
Speaker 5: how it just got reversed because you know, like you
Speaker 5: call your bank and you say I wasn't in Kansas City,
Speaker 5: and so he's like, oh, what if you could copy
Speaker 5: a credit card and then you could use it in
Speaker 5: a bunch of cities and then you claim it was fraud.
Speaker 2: It's like free money. He was very young.
Speaker 5: He was just a very young person, and young people
Speaker 5: are naive. And we said, first of all, no, I
Speaker 5: mean that's that is not like a crime. That is
Speaker 5: a crime.
Speaker 2: You can't do that. Two, we don't do that here.
Speaker 5: And three you've just said a lot of things that
Speaker 5: are very actionable in front of people.
Speaker 2: You should not. You don't. Don't do that, please please, Rea.
Speaker 2: And we talked.
Speaker 5: We talked to him a lot. Actually the parking lot.
Speaker 5: We the second day. We said we're sorry, we were
Speaker 5: going to have to we refunded you. We're like, this
Speaker 5: is not the class for you. I think you got
Speaker 5: the wrong idea. No harm, no foul.
Speaker 2: You know, we took it, We took the equipment back
Speaker 2: that you know.
Speaker 5: The kid, so he listened to a we had to say,
Speaker 5: and I think maybe it sent him on a better path.
Speaker 2: But that was that was a shocker for me.
Speaker 5: How how you could you know, look at our class
Speaker 5: description and come away thinking that that's what the class
Speaker 5: was about.
Speaker 2: And he just didn't know the security world really explained.
Speaker 5: He's like, why are all these other people in your class,
Speaker 5: and we're like, well, because they're doing it for good,
Speaker 5: Like they're doing it to test and work with these
Speaker 5: companies to make it better.
Speaker 2: Right, he had no idea that could be a career.
Speaker 2: He's like, that's so strange. Why would anyone do that?
Speaker 4: Yeah, it's fascinating. I mean I wonder, you know, because
Speaker 4: classes like yours, same as like tactical shooting classes or whatever,
Speaker 4: that there are probably a lot of wannabes out there
Speaker 4: right who take the classes and and and really and
Speaker 4: I don't mean want to be in an insulting way.
Speaker 4: It's just they had this idea of of being, you know,
Speaker 4: Johnny high speed. They take the class and never do
Speaker 4: anything with it.
Speaker 5: Yeah, but yeah, yeah, all the guys who saw john
Speaker 5: Wick and wanted to learn Center Access Relock.
Speaker 4: Is exactly exactly exactly. I do like Center Actions Relock though.
Speaker 4: But so it's interesting that you were like assists admin
Speaker 4: and network admin. I you know, in my mind, for
Speaker 4: some reason, I thought that maybe, you know, when you
Speaker 4: were doing the vanilla stuff, that you were like a
Speaker 4: locksmith or something.
Speaker 5: So I did get my certifications across the board, but
Speaker 5: that sort of came around the other direction later ever since,
Speaker 5: I have a rule for myself that every year I
Speaker 5: want to take at least one or two trainings of
Speaker 5: some kind just to learn, just to always be learning
Speaker 5: a new skill. I think you learn not just about
Speaker 5: the training that you're in. You learn it even I
Speaker 5: just I like teaching.
Speaker 2: I am a teacher by trade, right, and I just
Speaker 2: learned about teaching by watching other people teach.
Speaker 5: And I say, okay, boy, I wouldn't I wouldn't presented
Speaker 5: that concept that way. I would to think of it
Speaker 5: this way. So but yeah, just learning a new skill
Speaker 5: just to keep the brain as elastic as you can.
Speaker 5: So over time, I've added many credentials and letters to
Speaker 5: my name in this space just because I mean, it's like,
Speaker 5: I won't say a vacation for me, but it is
Speaker 5: a mental It is definitely a mental pleasure week when
Speaker 5: I go down to Lockmasters or Mark Bates Academy or
Speaker 5: the Savaga Safetech Conference something like that. These are skills
Speaker 5: that I sort of kind of had because I had
Speaker 5: self taught myself along the way and I wanted to
Speaker 5: all right now I think I know this. Let me
Speaker 5: sit in the class. Oh actually no, I didn't know
Speaker 5: the last ten percent of it. I didn't know this
Speaker 5: other this new tool exists. I learned that ten years ago,
Speaker 5: and now there's a new tool. So I'm finding great value.
Speaker 5: But at the end of these classes you wind up,
Speaker 5: you know, with paper you can hang on the wall,
Speaker 5: and then you wind up with actual certifications and accreditations,
Speaker 5: and I say, oh, that's pretty cool. So yes, I
Speaker 5: am a sav TO certified now certified professional safe Technician.
Speaker 2: I passed my CPS.
Speaker 5: I have in a lower number as a locksmith, I'm
Speaker 5: a forensic locksmith now, oh yeah, people like Tom DeMont
Speaker 5: and Drumpee. These these are icons of the forensics world.
Speaker 5: They taught me things that you can microscopically look inside
Speaker 5: of locks and see techniques and tools that might have
Speaker 5: been in there. Technically I could testify in court. I
Speaker 5: don't think I would survive a Daubert challenge or anything.
Speaker 5: I'm not a professional expert witness by trade things like
Speaker 5: the government Safe Work. I mean, I'm a I'm a
Speaker 5: GSA Safe Involved Technician and inspector. It's a very long
Speaker 5: long set of training. You take it at MBA or
Speaker 5: you take it at Lockmasters. It's two weeks long. I
Speaker 5: don't spend all my days on military bases and government installations,
Speaker 5: servicing safes and vaults.
Speaker 2: But I'm certified to I can help you build a skiff.
Speaker 5: And you know, the one time a year that we
Speaker 5: have a client who says, hey, we need a you know,
Speaker 5: skiff certified room in this new building, or the one
Speaker 5: or two times I'll do because you don't make a lot.
Speaker 2: Of money on a lot of these government jobs. They're
Speaker 2: they're they're GSA rates.
Speaker 5: But I'll get a call from an army base I
Speaker 5: live right near, you know, for Lewis McCord, or I'll
Speaker 5: get a call like there was a Secret Service office
Speaker 5: that called me and they said, hey, you know, we
Speaker 5: have this safe that we have to decomm usually decommissioning,
Speaker 5: but like, yeah, we're trying to break this office down
Speaker 5: and we can't throw this freaking safe out because there
Speaker 5: might be contents in it.
Speaker 2: The custodians long retired. We got to get somebody in there.
Speaker 5: And I'll take the job just for the fun of it,
Speaker 5: just to keep the skills fresh into it's fun. It's
Speaker 5: fun to make some sparks and make a little bit
Speaker 5: of smoke, and then you kind of turn your back
Speaker 5: as the custodian opens the control drawer and you hear like,
Speaker 5: there's there's a video on my YouTube channel where I
Speaker 5: actually they allowed me to record. And the screen goes
Speaker 5: black so you don't see what he's but you hear
Speaker 5: him go, oh man, there was way more in here
Speaker 5: than we thought there.
Speaker 2: Was a year. Oly, shit, there's a good gun in here,
Speaker 2: you know. Take that. Yeah, so I'll do it. I'll
Speaker 2: do it just for the fun of that.
Speaker 3: So let's start jumping into the topic of safety and
Speaker 3: safe cracking. I think before we get into the cracking aspect,
Speaker 3: we should probably talk a little bit about safes.
Speaker 4: Most people.
Speaker 3: I think most listeners know what a safe is and
Speaker 3: have some idea in their mind from like a Donald
Speaker 3: Duck cartoon guy turning the dial and the door opens
Speaker 3: and you keep your gold coins inside. But you want
Speaker 3: to talk a little bit about the development of safes,
Speaker 3: the modernization of them, what people use them for, the
Speaker 3: different types of safes that are out there.
Speaker 5: Certainly, certainly a safe or any storage container, a safe,
Speaker 5: a vault, a safe room. The idea is to make
Speaker 5: a container that is not impenetrable, because nothing's impenetrable, but
Speaker 5: you want to cause an attacker more headache than it
Speaker 5: would be ultimately worth for them to gain the spoils
Speaker 5: that are contained within. So if you have your jewelry
Speaker 5: in your house and your you know, your your important documents,
Speaker 5: whatever will assign a value to that. Maybe you have
Speaker 5: a very nice gun collection, your you know, you and
Speaker 5: your spouse and your kids have.
Speaker 2: Some valuable jewelry that you've gotten over the years.
Speaker 5: Call it, I don't know, fifty thousand dollars, one hundred
Speaker 5: thousand dollars, anything more than that. In terms of financial
Speaker 5: instruments and hard you should probably be putting them in
Speaker 5: a bank vault or a safe deposit box somewhere, in
Speaker 5: my opinion, but you might have fifty k. Well, an attacker,
Speaker 5: if they know that you have, that's a really wealthy home,
Speaker 5: let's break in there and steal stuff. If it's going
Speaker 5: to cost the attacker, like let's say ten twenty thousand
Speaker 5: dollars and specialize drill rigs, and like, I have all
Speaker 5: this safe cracking equipment, but it costs money, right, And
Speaker 5: it's going to cost the attacker a lot of time
Speaker 5: and effort, and they're making a lot of noise and
Speaker 5: they're worried about their exposure and their likelihood of getting caught.
Speaker 5: The attacker is going to kind of do the math
Speaker 5: and say, ah, it's not worth it. I'm going to
Speaker 5: break in somebody else's house down the road. A safe
Speaker 5: or a vault is designed to cause more headache, time delay,
Speaker 5: energy effort, and resource spend than the attacker would gain
Speaker 5: demonstrability by by the risk of breaking in. So historically
Speaker 5: this was all brute force, you see, you know, like
Speaker 5: the old the old West, like people dynamiting safes and
Speaker 5: things like that.
Speaker 2: That's that's what you would have.
Speaker 5: You'd have usually round almost like the old Victor cannon
Speaker 5: balls type safe. You'd have these cast iron, very thick doors,
Speaker 5: and the lock mechanism was was not something somebody would
Speaker 5: tinker with the lock and a combination on the lock
Speaker 5: was designed like if you didn't know the combination. People
Speaker 5: weren't teaching safe cracking as a skill broadly back then.
Speaker 5: It was all about that pry bars and nitroglycerine and
Speaker 5: how how can you withstand detonating the safe or if
Speaker 5: you had to blow the safe up, we'll it blow
Speaker 5: up all the money in it.
Speaker 2: I think that was in maybe some old Cowboy movie
Speaker 2: where they blow up a safe but then the money
Speaker 2: all gets you know, gets burned up inside the monton
Speaker 2: they're going through. This one's pretty good. I think this now,
Speaker 2: this bill is a lost cause.
Speaker 5: But over time we do run the risks of not
Speaker 5: just so sort of smack and grab.
Speaker 2: We started saying, well, what about.
Speaker 5: If an authorized person were to try to steal from
Speaker 5: the safe? What if somebody were to use duress on
Speaker 5: an authorized person and say, hey, you open the safe
Speaker 5: right now for me, Which didn't happen nearly as much
Speaker 5: as we are led to believe by Hollywood. It was
Speaker 5: actually very hard to hold up a town in the
Speaker 5: Old West because you'd have to get away right. I mean,
Speaker 5: there's only one or two roads out of town right
Speaker 5: there where to go.
Speaker 2: You're on a horse. Guess what everyone else is on
Speaker 2: a horse. Yeah, if your horse runs.
Speaker 5: Out of energy fifty miles outside of town, the people
Speaker 5: coming behind you with all their guns, they're gonna be
Speaker 5: right on your heels. Those sort of robberies like that.
Speaker 5: Bank robberies really change with the automobile. That's the history
Speaker 5: of modern bank robberies with sort of Dillinger and Bonnie
Speaker 5: and Clyde and Lamb. But the idea of a bank
Speaker 5: robber who would maybe not use brute force or duress,
Speaker 5: but who would use you know, like I'm going to
Speaker 5: be the inside man breaking in. That was also a
Speaker 5: real big concern in the government as we started to
Speaker 5: see the modernization of the intelligence apparatus in our country,
Speaker 5: which is really a product of the First World War,
Speaker 5: the interwar years with the OSS and then of.
Speaker 2: Course World War Two.
Speaker 5: It is when we get really the modern intelligence community,
Speaker 5: the idea of classified documents and document storage, and what
Speaker 5: if we have spies who have been bribed or leveraged, Well,
Speaker 5: this person knew the combination.
Speaker 2: It's not how robust the safe is and how we
Speaker 2: prevent that.
Speaker 5: So that's where we start to see things like the
Speaker 5: development of timelocks, where on the inside of the safe
Speaker 5: door there is a movement, there's a mechanical time movement,
Speaker 5: and you set it and until that clock winds down,
Speaker 5: the safe simply cannot be effectively opened. And timelocks were
Speaker 5: great for a while until, as I like to remind people,
Speaker 5: December seventh, nineteen forty one, the day that we'll live
Speaker 5: in infamy, was a Sunday and there's actual stories during
Speaker 5: the attack on Pearl where people were running around at
Speaker 5: the Navy base. They're running around Schofield Barracks, Hickham Field,
Speaker 5: and they're like trying to get into the safes to
Speaker 5: get the war plants because the Japanese zeros are flying
Speaker 5: out of the sky and things are blown up in
Speaker 5: the harbor and all of a sudden, Oh wow, war
Speaker 5: is seven days a week.
Speaker 2: We can't just use.
Speaker 5: Timelocks anymore for our government safes. Banks to this day,
Speaker 5: banks still use timelocks. Civilian world still uses timelocks extensively.
Speaker 5: But the development of manipulation resistant or what some people
Speaker 5: we call manipulation proof kind of anti manipulation safe mechanisms
Speaker 5: and dual custody safe locks. This is all a product
Speaker 5: of the Second World War and the immediate post World
Speaker 5: War two kind of Cold War era, the espionage era
Speaker 5: being really in its heyday. That's where we see the
Speaker 5: modern landscape of safes and vaults and mechanisms that are
Speaker 5: meant not just to resist brute force, but are meant
Speaker 5: to prevent unauthorized access from all different manifold angles.
Speaker 6: Hey, guys, our show is sponsored by ghost Bag. Check
Speaker 6: them out. Please to make awesome mattresses, Awesome pillows, awesome betting.
Speaker 6: Ghostpread provides high quality, is super comfortable, award winning mattresses
Speaker 6: crafted in the US and Canada. Did you know that
Speaker 6: sixty percent of US adults report being too hot when
Speaker 6: they're trying to sleep. That's me, I'm a sweaty little baby.
Speaker 6: That's why we designed all of our products with cooling
Speaker 6: features so you stay comfortable and asleep all night long.
Speaker 6: Pair any of our mattresses with ghost Beds Award winning
Speaker 6: adjustable base and get the ultimate sleep experience. Ghost Bearded
Speaker 6: Rules the family owned business sixty thousand plus five star reviews.
Speaker 6: They have sleep experts on staff with twenty plus years
Speaker 6: of experience. If you have any questions, you can hit
Speaker 6: them up and ask them, you know, maybe what kind
Speaker 6: of mattresses work for you. Twenty plus year warranty that's
Speaker 6: two times the industry standard. Free shipping and returns on mattresses.
Speaker 6: Most of the products ship out within twenty four hours.
Speaker 6: They have in house customer support and sleep actress Sleep
Speaker 6: experts chilling in Plantation, Florida. It rules It's the best.
Speaker 6: They give you one hundred and one night's risk free
Speaker 6: to make sure that these beds are right for you.
Speaker 6: If you don't like it after one hundred and one nights,
Speaker 6: you could send it back full refund.
Speaker 2: Uh.
Speaker 6: When you purchase a ghost bed mattress, you're comfort guaranteed.
Speaker 6: I'm reading it right now, and it's capital letters guaranteed. Okay,
Speaker 6: they do the right thing and they're a great company.
Speaker 6: If you're not sure which ghost bed's right for you,
Speaker 6: like I said before, you could take you could take
Speaker 6: their mattress quiz online or you can give a call
Speaker 6: to one of their sleep experts and they'll help you
Speaker 6: with exactly what you possibly could need, what works for you,
Speaker 6: and what doesn't. And the best news about this is
Speaker 6: teamhouse listeners and viewers. You get an extra ten percent
Speaker 6: off sitewide for a limited time. You just go to
Speaker 6: ghostped dot com slash house and use the code house
Speaker 6: at checkout one more time. That's ghost sped dot com
Speaker 6: slash house with the code house ho u se at
Speaker 6: checkout for an extra ten percent off site wide. I
Speaker 6: want to thank go sped for their continued support. I
Speaker 6: want to thank all the fans that listen and watch
Speaker 6: for their continued support. Without you, guys, we are nothing.
Speaker 6: So thank you for supporting the show, and thank you
Speaker 6: for supporting the companies that help support the show. Gospad
Speaker 6: dot com, slash House for ten percent off, made in
Speaker 6: the US, Made in Canada. Shout out to our brothers
Speaker 6: in Canada. They rock. Check them out. I love ghosped.
Speaker 6: Thanks guys.
Speaker 3: Hey, guys, I want to tell all of you today
Speaker 3: about a new newsletter that we're launching that encompasses both
Speaker 3: the Teamhouse podcast, the eyes On podcast, and the high
Speaker 3: Side News outlet, which I run with Sean Naylor. The
Speaker 3: newsletter is going to be once a week. It's going
Speaker 3: to come into your inbox and you're going to get
Speaker 3: the most current podcasts on eyes On and the Teamhouse
Speaker 3: and whatever's topical or current on the high Side. So
Speaker 3: it's another way for us to get the information out
Speaker 3: to you as social media algorithms are pretty iffy and
Speaker 3: you never really know.
Speaker 4: What you're gonna get. So this is a once a
Speaker 4: week email.
Speaker 3: It'll slide into your inbox and it will have you
Speaker 3: know the greatest hits of that week.
Speaker 4: It's really good man checking it out.
Speaker 3: The website for it is Teamhouse Podcast, dot kit dot com,
Speaker 3: slash Join Teamhouse podcast, dot kit dot com.
Speaker 4: Slash join.
Speaker 3: H you go there and you enter into your email list,
Speaker 3: or you enter your email into the little thing on
Speaker 3: the website and you're good to go, and that'll be it.
Speaker 3: So we really appreciate your support and hope you'll consider
Speaker 3: signing up.
Speaker 2: Where's the link.
Speaker 3: The link will also be down the description if you're
Speaker 3: looking for it there.
Speaker 7: And that's Teamhouse podcast, dot Kit, k I, t Kilo, India,
Speaker 7: Tango dot com, backslash Join.
Speaker 4: Fascinating And so I never knew that about World War Two?
Speaker 4: Did you jack about Pearl Harbord? Yeah, first time or that? Fascinating?
Speaker 4: So what yeah, what are the steps to you know,
Speaker 4: because like you know, when we look at modern movies
Speaker 4: or even older movies, you know, the criminal always gets
Speaker 4: an exact replica of the safe and then they spend
Speaker 4: you know, days or weeks practicing on it with their
Speaker 4: stethoscope or you know, their drill where it just hits
Speaker 4: the glass pane. But what are the actual steps for
Speaker 4: a modern like safe cracker?
Speaker 5: So that's a really cool question. And a guy I
Speaker 5: like very much. He's been in touch with me in
Speaker 5: the past. He's an icon of the industry. Dave mccomy.
Speaker 5: He actually appears in some videos online.
Speaker 2: He's been interviewed about how realistic was this or that
Speaker 2: scene in a movie. He has a wonderful walkthrough.
Speaker 5: I'll send you the URL if you'll put in the
Speaker 5: show out puts for people. But it is true that
Speaker 5: safe crackers and technicians need to know, like what's on
Speaker 5: the other side of that steel door, what is the
Speaker 5: mechanism and learning about it, either by getting a replica
Speaker 5: of the safe or if you're on the up and up,
Speaker 5: if you're in the actual SAFTA Safe Involved Technicians Association land.
Speaker 2: There's a whole knowledge database.
Speaker 5: There's there's the List Council, there's locknet, there's whole databases
Speaker 5: that you can reference that show oh this From this
Speaker 5: year to this year, dee Bold Mosler was making their
Speaker 5: vault doors with this mechanism and this bolt work on this.
Speaker 5: So this is where the mechanism is, this is where
Speaker 5: the drill point is. This is where you want to
Speaker 5: be careful. There's a relock trigger over here, there's a
Speaker 5: relock device over here. So knowing what's on the inside
Speaker 5: is often the first step in trying to either neutralize
Speaker 5: a safe or even just diagnose a problem, you know,
Speaker 5: figuring out Oh, okay, the safe was working yesterday, customer
Speaker 5: reports it doesn't work today.
Speaker 2: Well, if you roll up over there and you say,
Speaker 2: how are.
Speaker 5: You show me how you're dialing the safe, and you
Speaker 5: watch them and you say that that should work.
Speaker 2: Is that not working?
Speaker 5: And then you think to yourself, way, I know safe
Speaker 5: technicians that have safe different models of safelock, you know,
Speaker 5: in their van, and they'll deuld a cutaway and they'll
Speaker 5: they'll actually.
Speaker 2: Wait a minute. If I'm if I'm turning a clockwise
Speaker 2: what the what the frig am I doing? They're looking
Speaker 2: at they go, no, no, no, the fly.
Speaker 5: Okay, so you might have a stuck fly going counter counterclockwise. Okay,
Speaker 5: try it this way here, turn the thing and you
Speaker 5: can get a dead blow hammer and you say, wait,
Speaker 5: don't turn the number. Bang tile the next number now okay, okay,
Speaker 5: Now you're about to hit the bolt.
Speaker 2: Work on this side, bam. Okay. Yeah, we got to
Speaker 2: open cool because you need to know if I hit
Speaker 2: it right about here, if something stuck or wasn't greased.
Speaker 4: Yeah.
Speaker 5: Knowing what's on the inside of the door is a
Speaker 5: huge part of the whole process.
Speaker 4: Fascinating, it's fascinating.
Speaker 3: Do you want to talk a little bit because I
Speaker 3: think during your talk at def Con you mentioned this
Speaker 3: a little bit about what the stethoscope actually was and
Speaker 3: how there was a period maybe a brief period of
Speaker 3: time where that was useful but not today.
Speaker 4: Yeah.
Speaker 5: Yes, so to this day, if you're doing manipulation, this
Speaker 5: is with mechanical, purely mechanical safe locks.
Speaker 2: I mean there are attacks for electronic safes as.
Speaker 5: Well, but manipulation, as we've often seen in Hollywood, you'll see,
Speaker 5: as you mentioned, the stethoscope or the low tech is
Speaker 5: like putting the you know, the ear up to a
Speaker 5: glass or something like that. You're not really hearing a
Speaker 5: lot of many mechanisms clicking and clanking, like the Foley
Speaker 5: guy doing the production of a film likes.
Speaker 2: To add all these sound effects.
Speaker 5: What you're trying to find is very precisely learning what
Speaker 5: are called contact points. It's a very specific area of
Speaker 5: the safe dial where to use some technical terms, where
Speaker 5: the nose on the lever arm is trying to drop
Speaker 5: into the opening on what's called a cam wheel and
Speaker 5: you're trying to find okay, touch here, touch here, and
Speaker 5: as you're dialing the dial. You're dialing this cam wheel touch, touch, touch,
Speaker 5: and you want to get those contact points very care fully,
Speaker 5: carefully identified, because as you manipulate, the process of manipulating
Speaker 5: a safe is experimenting with different numbers around the wheel
Speaker 5: and seeing if those contact points change very slightly, it's
Speaker 5: actually happening. And I don't know if your viewers are
Speaker 5: getting this and audio only if they're seeing my hands
Speaker 5: in front of my black shirt here, but imagine if
Speaker 5: that nose is dropping a little further into an aperture,
Speaker 5: those contact points will get a little tighter together than
Speaker 5: they would if you were up here higher up. You're
Speaker 5: looking for where the safe wheels are almost lined up
Speaker 5: but not fully lined up, and you're taking notes. You say, oh,
Speaker 5: something's happening around seventeen, question mark seventeen, and you come
Speaker 5: back and you run the numbers again and you say, okay, no,
Speaker 5: I'm seeing something on forty two maybe, And you're slowly
Speaker 5: getting the safe to leak information out at you. But
Speaker 5: as Dave and others have pointed out in their videos
Speaker 5: about the subject, you're doing much more visual observation. So
Speaker 5: it's fine if you want to use a stethoscope, or
Speaker 5: in modern times we would use an audio amplifier a
Speaker 5: little magnetic microphone. You could hear the contact points, but
Speaker 5: you're never in Hollywood. You're often just kind of you
Speaker 5: see the person is looking off into space as they're
Speaker 5: just listening, just listening. What you're really doing is listening
Speaker 5: and looking particularly.
Speaker 4: And what are you are you looking for like little
Speaker 4: hitches and then as the dial goes or something like that.
Speaker 5: Yeah, you're looking for the behavior of the dial at
Speaker 5: a very specific spot where it would be called the
Speaker 5: drop in area.
Speaker 2: That's where the contact points are.
Speaker 5: And if those contact points, if I'm running the dial
Speaker 5: and my contact points are always let's call it ninety
Speaker 5: eight and seven, and I run the dial some more
Speaker 5: ninety eight seven, ninety eight to seven, and then I'm
Speaker 5: starting to and I get to a point where I'm
Speaker 5: trying some numbers, and then I come back to my
Speaker 5: contact points.
Speaker 2: And then all of a sudden, it's at ninety nine
Speaker 2: and six, Like my contact points got a little tighter together.
Speaker 5: I think my nose is dropping a little further into
Speaker 5: the cams.
Speaker 2: Let's jot that down.
Speaker 5: I might have a good number there now, just because
Speaker 5: you found a potential number, or you don't know where
Speaker 5: in the combination that is, there's a series of diagnostic
Speaker 5: dialing techniques that you would use to try to determine
Speaker 5: where on the dial or where in the combination.
Speaker 2: That the dial should be dialed to that number, and
Speaker 2: little by then.
Speaker 5: And sometimes it's fun sometimes if you're working with the
Speaker 5: customer and you say, I'm finding a seventeen and I'm
Speaker 5: finding a seventy six, and they say, oh, yeah, that's right,
Speaker 5: Dad loves seventeen seventy the real patriot. That's the second
Speaker 5: and third digits. I remember that now, and say, well,
Speaker 5: does that jog your memory?
Speaker 2: Oh? Do you remember the first friggin digit? We could just.
Speaker 5: Dial for dollars, so we could just try all the
Speaker 5: that you just reduce the key space to hell them
Speaker 5: a lot by selling me.
Speaker 4: That, Yeah, what you know, this itself sounds like it's
Speaker 4: own specially right. And then you have all of the
Speaker 4: alarm bypass, electrical bypass, all the different types of sensors,
Speaker 4: all the different types of doors. Would you consider yourself
Speaker 4: an X in all these things? Or do you consider
Speaker 4: yourself like an expert in entry and being a generalist
Speaker 4: and then like being able to brush up on stuff
Speaker 4: as needed.
Speaker 5: I think it's the hallmark of hubris of the worst
Speaker 5: kind to consider yourself an expert in too many things,
Speaker 5: or maybe any one thing at all. So I'll be
Speaker 5: the first to point out I'm not necessarily an expert
Speaker 5: in almost anything, but I'm a dedicated I'm a dedicated
Speaker 5: person in many things. We will say there's a lot
Speaker 5: of people I work with who disagree with me and
Speaker 5: say I'm being too modest, probably, but that's for them
Speaker 5: to come on and tell you about later. They can
Speaker 5: talk about me. I'll talk about I work with plenty
Speaker 5: of experts. I work with the electronic access control expert,
Speaker 5: my colleague bobik who owns RTA and Core. I work
Speaker 5: with my alarm system expert, our guy Brian, who came
Speaker 5: out of the intelligence communities. Right, But I am I
Speaker 5: am a specialist in several things, and I believe in
Speaker 5: broadening your horizons as much as possible, which again it's been,
Speaker 5: it's been an amazing journey.
Speaker 2: I never was the ones and zero's person.
Speaker 5: I mean, I was a network person, but I never
Speaker 5: was an access control electronic locks person at all, and
Speaker 5: through sitting it first, just sitting in the back of
Speaker 5: the room. When you know a Red Team Alliance Access
Speaker 5: Control class, I would just kind of sit in the
Speaker 5: back in case somebody needed me to hand them something.
Speaker 2: When I got to hand out the next access I'll
Speaker 2: hand out the access control cards.
Speaker 5: And then I would, you know, sit up front with
Speaker 5: Bobbic and I would help him. I can teach the
Speaker 5: basic pros cloning, I can. I can do that module
Speaker 5: if you need to take a break from your easier voice.
Speaker 5: And now I routinely fill in running whole sections of
Speaker 5: the Access control class just because I work with these
Speaker 5: exceptionally skilled people and it's rubbed off on me.
Speaker 2: It's made me better to take Trent.
Speaker 5: Just like the uh, you know, the forensics thing, Like,
Speaker 5: I'm not an expert by any means at forensics, but
Speaker 5: I wanted to learn lock forensics.
Speaker 2: And you keep seeing these guys, you say, you gotta
Speaker 2: come to my next class, man. You YouTube that yoused
Speaker 2: to the first class, but let's come take the advanced
Speaker 2: class next month. It's like, man, I don't do this
Speaker 2: for a living. It's like, yeah, but you were great
Speaker 2: in classes, sir.
Speaker 5: Just come to your class man, and all of a
Speaker 5: sudden you look around, you go, holy crap, Am I
Speaker 5: better at this than the average bear?
Speaker 2: Uh?
Speaker 3: Let me also ask you about some of the other
Speaker 3: tools that get used. You mentioned, you know, there's like
Speaker 3: twenty thousand dollars drills, specialized drills. I've also heard about
Speaker 3: the thermic lance gets used sometimes. Channeling our knowledge from
Speaker 3: James Can's role in Thief, I think that's a nineteen
Speaker 3: eighty one film, great movie. But anyway, what do he
Speaker 3: What are some of the other tools of the trade
Speaker 3: that get used even as we move forward into the
Speaker 3: era of electronic locks?
Speaker 5: Right on, right on, And yes, m Jimmy Kahn in
Speaker 5: Thief is as a real rig that he is using.
Speaker 5: The whoever their technical advisor was on that film is
Speaker 5: exact because and again like Dave, Dave Mcomby did a
Speaker 5: whole breakdown of that movie in one of his videos online,
Speaker 5: and it's just it's.
Speaker 2: And also I just like, well, I love Michael Man's work.
Speaker 5: So it's like a whole world where cities are always
Speaker 5: perpetually wet and at night. I just want the look
Speaker 5: of it and the idea of these these big rigs.
Speaker 5: What you're trying to do with most professional safe cracking
Speaker 5: gear is apply force without fatiguing yourself and maintaining a
Speaker 5: drill in a very accurate spot, because anybody can just
Speaker 5: kind of go up with a giant Like when I'm
Speaker 5: breaking into a government safe and they're taking it out
Speaker 5: of service completely, I mean, I'll make a pretty big
Speaker 5: friggin hole in it. I'll just I'll use a giant wholesaw,
Speaker 5: and even then I'm still trying to not fatigue my arms.
Speaker 5: I have a rig that'll mount to the front of
Speaker 5: the of the safe, so I can just crank on it,
Speaker 5: use a big quill. But you're trying to apply pressure
Speaker 5: in a way that you can get through. Because they
Speaker 5: are all different kinds of material, there's all kind of
Speaker 5: metallurgy and cutting science. Are you doing a metal cutting technique,
Speaker 5: are you doing a grinding technique? Are you doing precision
Speaker 5: cutting where you're actually switching bits. There are plenty of
Speaker 5: times where you're going through different styles of material. So
Speaker 5: there's different types of barrier mesh. Where it's it's soft
Speaker 5: mild steel, then it's the hard steel plate, then it's
Speaker 5: ball bearings. It's something that's like hard plate that you
Speaker 5: can't cut through with high speed steel you have to
Speaker 5: switch to a diamond cutter where you're actually couring it
Speaker 5: out and you're punching and you're cracking it away and
Speaker 5: you're knocking debris out of a hole.
Speaker 2: And then you switch.
Speaker 5: Maybe you come up to maybe you're using, as you say,
Speaker 5: a burning bar or thermic lance, and then there might
Speaker 5: be a layer of material like copper in the middle
Speaker 5: of the sick just to distribute the heat so and
Speaker 5: copper won't a blake away. You can't oxidize like you
Speaker 5: can do an oxidizing burn on cop do you have to.
Speaker 2: Switch to switch to another tool, and all of these things.
Speaker 2: It raises the stakes for the attack, and it raises
Speaker 2: the level of investment that the attacker would have to have.
Speaker 2: If this is your livelihood and you have a full
Speaker 2: safetech shop, you have all the tools for an attacker
Speaker 2: to break in. If they weren't playing, if this is
Speaker 2: their one big score, they're not going to get through
Speaker 2: all of that.
Speaker 5: They would have to invest in so much time and training.
Speaker 5: But yeah, the precision point, if you're even a quarter
Speaker 5: inch off, you can not only miss your pot like
Speaker 5: what you're drilling for, you can ruin the job. You
Speaker 5: can not only fail to open it, you can make
Speaker 5: it inoperable, completely unable to be opened ever again, well
Speaker 5: without completely destroying a whole other side of the safe,
Speaker 5: let's say, so maintaining that exact precision point. That's why
Speaker 5: you see these large rigs that will be fixed in place,
Speaker 5: either with a vacuum pump or magnetically attached, or by
Speaker 5: some other means of stabilization.
Speaker 4: I think all I ever learned was drill a hole
Speaker 4: in it, filat with water and put some blasting cap center.
Speaker 4: So I guess I guess that, uh, I guess that
Speaker 4: the score.
Speaker 2: The score was one of Brando's last pictures. De Niro
Speaker 2: is in that with the young Ed Norton, and that
Speaker 2: is it is based on a type of technique that
Speaker 2: has been done. You.
Speaker 5: The one major thing about that movie that's not really
Speaker 5: is most safes aren't water tight. So in that movie,
Speaker 5: they actually tap the I believe it's they tap the
Speaker 5: sprinkler system.
Speaker 2: They pull up a big.
Speaker 5: Hose water down, and it wouldn't work that way in
Speaker 5: real life. Which also I'm a I am a I'm
Speaker 5: a fire services technician. Now I do a lot of
Speaker 5: life safety and fire suppression inspection. And do you know
Speaker 5: that if water is flowing through any sprinkler head, it'll
Speaker 5: set off alarms in a building.
Speaker 2: There's flow sensors that are.
Speaker 5: All tied into any building automation and emergency services controls.
Speaker 5: So you can't just get a bunch of water out
Speaker 5: of the out of a sprinkler head and have nothing
Speaker 5: go wrong in the building.
Speaker 2: That won't work.
Speaker 5: But that was a real technique. Yeah, but you would
Speaker 5: have to tape the entire safe up.
Speaker 2: You'd have to fill the whole safe with water by
Speaker 2: sealing the entire safe shut.
Speaker 4: That's fascinating. So with you know, Jacket mentioned you know,
Speaker 4: like I think you mentioned biometrics, but like you know,
Speaker 4: because both with your regular sort of breaking and entering stuff,
Speaker 4: and you know, with the advent of the flipper and
Speaker 4: you know, and all these other tools that are out
Speaker 4: there now and with safe and security we see biometrics.
Speaker 4: Are these systems more secure, less secure, or just secure
Speaker 4: in a different way.
Speaker 2: The diplomatic answer is that I like your phrasing.
Speaker 4: They're secure in.
Speaker 5: A different way. They are solving for a different problem. Nowadays,
Speaker 5: loads of businesses you're let's stay a convenience store, you know,
Speaker 5: like a seven to eleven or something might have a
Speaker 5: cash safe. You know, the sticker on the door. Teller
Speaker 5: does not have access to safe no more than twenty dollars.
Speaker 2: Blah blah blahlah blah.
Speaker 5: Those used to all be mechanical locks, and the teller
Speaker 5: in fact would not the kid working the register wouldn't
Speaker 5: have the combination was just the money drop guy and
Speaker 5: the manager.
Speaker 2: Those introduced a lot.
Speaker 5: Of user friction, and they weren't really preventing a lot
Speaker 5: of robberies. They you know, nowadays, if somebody is going
Speaker 5: to try to steal from a money drop, they're going
Speaker 5: to rob the bread truck, right, They're going to rob
Speaker 5: the a car, the armored car. So they said, why
Speaker 5: are we using these mechanical locks that are more cumbersome
Speaker 5: to maintain. They're harder for a lot of customers to
Speaker 5: learn how to use. Customers didn't really understand we live
Speaker 5: in a world of keypads nowadays. If someone can dial
Speaker 5: a phone, they can understand how to use a keypad.
Speaker 5: Electronics safe safe technicians, especially older guys, didn't like the
Speaker 5: introduction of electronics because they were quote less secure and yeah,
Speaker 5: there's electronic bypads is a way easier than the mechanical one.
Speaker 5: There is a tool called the Phoenix. There's a tool
Speaker 5: called a little black box. We won't get way into
Speaker 5: what's called differential power analysis, and that's how these tools work.
Speaker 5: But there are tools that will pop up in a
Speaker 5: lot of electronic locks very quick But that's not the
Speaker 5: main problem that a lot of these safe manufacturers and
Speaker 5: small businesses are solving for. The main problem they're solving
Speaker 5: for is I need a way to very quickly operate
Speaker 5: a safe and if I change the combination, I know
Speaker 5: how to write down the com I know how to
Speaker 5: enter the new combination.
Speaker 2: I won't forget it.
Speaker 5: And that Their day to day problem isn't a stick
Speaker 5: up or a robbery. Their problem is like, Hey, the
Speaker 5: guy from Brinx is waiting here and he's yelling at me,
Speaker 5: and he says, sorry, you're taking too long.
Speaker 2: I don't know what you're doing wrong. I'm going to
Speaker 2: get you next week.
Speaker 5: Right, So, electronic blocks are more convenient, they're not always
Speaker 5: they're definitely not more secure.
Speaker 2: In my opinion.
Speaker 3: Right Right, Let's jump into the history of intelligence services
Speaker 3: and how they intersect with this field to add a
Speaker 3: little bit of context. For folks out there of like,
Speaker 3: I think we should talk a little bit about why
Speaker 3: this matters. Intelligence services are known to, amongst other things,
Speaker 3: break into embassies and break into safes and those embassies
Speaker 3: if not just take the safe out and break into
Speaker 3: it off site somewhere. There's an article in Smithsonian magazine
Speaker 3: that I think a lot of you guys would be
Speaker 3: interested in. It's called the CIA Burglar Who Went Rogue
Speaker 3: about this guy named Douglas Grout, and it's about this
Speaker 3: guy who was a safe cracker for the CIA and
Speaker 3: he broke into safes in all sorts of different embassies
Speaker 3: and different parts of the world, and then he felt
Speaker 3: that he got screwed over and he sort of tried
Speaker 3: to blackmail the CIA for money and did it goes
Speaker 3: so well? But that's an interesting article to talk about,
Speaker 3: you know, how these intelligence services have these capabilities. I
Speaker 3: don't know if you read that one deviant and what
Speaker 3: your thoughts are about that particular incident.
Speaker 5: Yeah, So the real fascinating thing about the IC world
Speaker 5: is that these are technicians who aren't breaking in to
Speaker 5: safes in a way that is easily detectable. Right many times,
Speaker 5: I'm I can teach manipulation to anybody, any of y'all.
Speaker 5: Like we teach a manipulation class at RTA, But for
Speaker 5: the most part, I'm not usually manipulating a safe.
Speaker 2: If somebody says, hey, this safe, you know, needs to
Speaker 2: get opened, and even your best technicians nowadays drill and
Speaker 2: repair and patch it up.
Speaker 4: You can.
Speaker 5: We can patch it up so it looks like we
Speaker 5: were never there, but that takes a little while. And
Speaker 5: if somebody inspects the inside of the safe, they can see, oh.
Speaker 2: Yeah, look, take the panel off. You can see, oh
Speaker 2: there's there's somebody was in here.
Speaker 5: So getting into a safe in the way that even
Speaker 5: with dedicated inspection, it does not look like anyone was
Speaker 5: ever there. That's kind of the real bread and butter
Speaker 5: of the intelligence community. And that's the scariest thing because
Speaker 5: if you know somebody broke in, you can respond. You
Speaker 5: can either change your security posture going forward, or if
Speaker 5: you had a list of important documents in there, you
Speaker 5: can well, those documents are now compromised. We're not going
Speaker 5: to use those root plans, We're not going to use
Speaker 5: these assets anymore. If somebody in the intelligence world really
Speaker 5: just kind of goes out there and operates in a
Speaker 5: way that isn't easy to detect.
Speaker 2: That's really freaky.
Speaker 5: That's really scary because they could be operating for a
Speaker 5: long time without people reporting the crimes. And it's there
Speaker 5: have been instances where professional technicians. If I'll give you one,
Speaker 5: you mentioned that article for your viewers, I'll try to
Speaker 5: give you one again.
Speaker 2: I don't know. If you do show notes, I'll find it.
Speaker 5: There was a crew of professional safe technicians. I believe
Speaker 5: they operated mostly around the American Southeast, out of Florida
Speaker 5: and other parts of Georgia. They would use general Aviation
Speaker 5: flying VFR. My wife, you know, my wife's almost an
Speaker 5: aspiring pilot and my friend Alyssa's a pilot. Like VFR
Speaker 5: visual flight rules. You don't have to fly all flight plans.
Speaker 5: You can just take your little Cessna or your little
Speaker 5: Piper cub or something and just fly to another city.
Speaker 5: And if you follow you know, the rules of the sky,
Speaker 5: like you're just okay, I'm flying at the right altitude
Speaker 5: and then I land, okay. Radio and these guys we're
Speaker 5: bouncing around to different towns and getting in and getting
Speaker 5: out over the course of a weekend, not staying in
Speaker 5: you know, hotels, or anything like that under their names,
Speaker 5: and it was people couldn't figure out like this is
Speaker 5: like professional safe technician work. And the cops and the
Speaker 5: FBI were looking at lock shops like in that town right, like,
Speaker 5: we're all your employees here. Didn't we take any tools
Speaker 5: home this weekend?
Speaker 2: What happened?
Speaker 5: How is this is professional work? Eventually, eventually they got caught,
Speaker 5: as many criminals do. But yeah, in the government land,
Speaker 5: the idea of that what we would call a clandestine entry.
Speaker 5: Quick bits of terminology for anybody's interested in the forensic
Speaker 5: classifications of things you have overt, covert, surreptitious, and clandestine,
Speaker 5: and these speak to the questions of who will notice
Speaker 5: and how will they notice that something bad has happened overt?
Speaker 5: Anyone can understand, right, if I make a giant hole
Speaker 5: with a wholesaw in a small government filing cabinet that's
Speaker 5: locked up and it's going to the scrap heap, a
Speaker 5: giant freakin' hole and I'm not repairing it, that's very overt.
Speaker 2: Who will notice?
Speaker 5: Anybody will notice with their naked eye, and how will
Speaker 5: they note? They'll just look at it that frings out
Speaker 5: a hole in it. Covert when you talk about covert operations,
Speaker 5: it doesn't mean there's no evidence. It just means that
Speaker 5: someone would not notice the evidence unless they had special training.
Speaker 5: So if I'm leaving small scratches or marks on a
Speaker 5: surface of a door because I was using some hook
Speaker 5: to by pass my way into a room, anybody could
Speaker 5: see that. You don't need magnification, like, oh, look, there's
Speaker 5: some scratches on the latch.
Speaker 2: But unless someone's had special training, it wouldn't put two
Speaker 2: and two together to say, oh, I want those Those
Speaker 2: are not regular wear and tear. That's a that's a
Speaker 2: bypassed latch tool.
Speaker 5: It's a covert entry, surreptitious. Now we get one better.
Speaker 5: Who will notice somebody with training? How will they notice?
Speaker 5: They're specifically looking for it, with investigative techniques, They're not
Speaker 5: just seeing it with the naked eye. They say, all right,
Speaker 5: and let's get the magnifiers out with dust it. Let's
Speaker 5: look inside. That's the forensic locksmithing I'm working. I'm seeing
Speaker 5: signs of surreptitious entry inside of a lock usually, but
Speaker 5: clandestine is the real as the real big one, right,
Speaker 5: that's when who will notice?
Speaker 2: Nobody? How will they notice? They won't you're not leaving
Speaker 2: attributable evidence that points to the nature of the crime
Speaker 2: or points back to you, or if you're you know,
Speaker 2: the government, it doesn't point back to you.
Speaker 5: As a friendly power. You know, it's not like your
Speaker 5: your embassy's not getting a phone call. So that kind
Speaker 5: of skill that is that because if you break into
Speaker 5: a government safe, the value is not, hey, I got
Speaker 5: those secret documents. The real value is we got the
Speaker 5: documents and they don't know that we got them.
Speaker 4: It's interesting because that's not just with safe cracking, but
Speaker 4: that I remember that section in Tool where they had
Speaker 4: all the different package at Defcon, the you know, the
Speaker 4: fool corner. They had all the different.
Speaker 2: Packages, the tamper seals.
Speaker 4: Yeah, the tamper seals and all that stuff, and you
Speaker 4: know people sitting there, you know, just patiently applying like acetoine.
Speaker 4: I don't even know what they use, but you know,
Speaker 4: how do how do I take what's in this box
Speaker 4: out of this box and put all of the you know,
Speaker 4: tamper seals back on the box so nobody knows I
Speaker 4: got in. Fascinating stuff.
Speaker 2: So yeah, yeah, acetone is one of the things you
Speaker 2: would use.
Speaker 5: Yeah, you can use very pure acetone isopropol as popular.
Speaker 5: You'll see the real secret sauce is A is A
Speaker 5: is a non POLYMERA. It's a I'm trying to think
Speaker 5: it's a non polar solvent. It's called end heptane.
Speaker 2: Uh, yeah, that's end. Heaptain does some wild stuff.
Speaker 5: You can you can lift seals off of all kind
Speaker 5: of weird substrates and it doesn't There could be ink
Speaker 5: like serial numbers on the seal and if you smear
Speaker 5: that with acetone, that ink's gonna run right, And heptane
Speaker 5: is lifting solvent that doesn't even smear the ink.
Speaker 2: It's amazing.
Speaker 4: Crazy stuff.
Speaker 3: So let's see to where to pick up on this.
Speaker 3: Where do you want to start? As far as you know,
Speaker 3: Cold War with KGB and CIA trying to break into
Speaker 3: and steal the other secrets.
Speaker 5: Yeah, so that's a great We talked about timelocks and
Speaker 5: how we realized that in the government of military space
Speaker 5: timelocks they ain't it like it's not going to not
Speaker 5: going to do the job. So we've had to develop
Speaker 5: what we thought and many manufacturers touted as manipulation resistant
Speaker 5: or manipulation proof mechanisms, and over the years, the only
Speaker 5: clandestine technique was that very slow methodical manipulation that I
Speaker 5: described just dial manipulation. If you defeat that or make
Speaker 5: it very hard to do, and there's there's mechanical ways
Speaker 5: you can do that. If if any of the listeners
Speaker 5: have ever had a combination lock that they've had to
Speaker 5: enter a combination and then do another thing, twist a
Speaker 5: little what it's called a butterfly knob knob or push
Speaker 5: the dial in or there's it depends on maybe you're
Speaker 5: opening weapons lockers A twenty nine thirty seven or an
Speaker 5: old eighty four hundred series like these were designed to
Speaker 5: prevent manipulation or make manipulation very hard. The intelligence services
Speaker 5: that tried to get around that there there are ways
Speaker 5: to manipulate what are called group one safes the locks
Speaker 5: that it's just so challenging. They said, all right, we
Speaker 5: need a better way, we need we need some other technique.
Speaker 5: What we started to see, and this this is coming
Speaker 5: up around you know, the fifties and really the sixties,
Speaker 5: we started to see the use of radiographic techniques, gamma
Speaker 5: graph methods, where I mean it just it sounds utterly
Speaker 5: bananas when you describe it to people, but the use
Speaker 5: of a high emittance radioactive isotope placed behind or even
Speaker 5: sometimes within the safe mechanism, because on vault bars they
Speaker 5: would do this by making a pinhole in the in
Speaker 5: the doorframes sometimes, or if it's a safe, you could
Speaker 5: just move the safe away from the wall and put
Speaker 5: the radioactive ice toove behind the safe. If they couldn't,
Speaker 5: they would get more isotope and just bring it in
Speaker 5: the next room.
Speaker 2: To'd be like, all right, which go to the next room.
Speaker 2: Just put it over there, and you're putting film like
Speaker 2: you're literally putting an X ray film in front of
Speaker 2: the safe and developing an image to see what's happening
Speaker 2: inside the safe.
Speaker 5: Flock block, and then you have to reverse out. There's
Speaker 5: a whole technique about it. I mentioned this in a
Speaker 5: talk that I gave recently about a team from Poland.
Speaker 5: There's a team they were just called like Division nine,
Speaker 5: like you know, the special Squad number nine. They were
Speaker 5: the Invisible team. In fact, the name of the there's
Speaker 5: a book all about it. It's called Nivid Jumpy. It's
Speaker 5: a book it means invisible. It's in Polish. The whole
Speaker 5: book is in Polish by Thomas Avasovitch. He's a Polish
Speaker 5: investigative journalist. And what Division nine, right, well, a special
Speaker 5: Group Number nine was doing. At the time, Poland was
Speaker 5: part of the Warsaw Pact. They were part of the
Speaker 5: com Block for right, so they were breaking into our
Speaker 5: embassies and our NATO Allies embassies using these techniques. The
Speaker 5: reason we know about it now is because, of course
Speaker 5: Poland is no longer. The Warsaw Pact doesn't exist. Poland
Speaker 5: late in the Cold War, I mean they flipped, right,
Speaker 5: Poland became part of our ally ship and all these
Speaker 5: intelligence operators suddenly were collaborating with us.
Speaker 2: Some of them we would just debrief them.
Speaker 5: Others were people that had to come to the West
Speaker 5: for like medical treatment because they were handling these freakin
Speaker 5: isotopes right, very unsafely.
Speaker 4: Yeah, I was wondering about that. Where they you know,
Speaker 4: because like when you get their X rays, how you
Speaker 4: have to wear the like the you know, the lead thing,
Speaker 4: Like I can't imagine it was good for their health.
Speaker 2: No, it was not.
Speaker 5: And these guys knew that they were taking a hit.
Speaker 5: They wore docimitar badges and such, and some of them knew.
Speaker 5: But they was all for you know, it was their
Speaker 5: job is where they saw it. And even just transporting
Speaker 5: the isotopes around, they kind of rigged up these not
Speaker 5: really safe cans just to make them slightly man portable,
Speaker 5: and they you know, they used just docimiters and other
Speaker 5: measuring devices outside the container.
Speaker 2: They're like, man, these are not these are not doing
Speaker 2: the job. They're not good.
Speaker 5: They'd tell stories about how if they were on long jobs,
Speaker 5: or they would drive from city to city, they would
Speaker 5: put the the isotope in the trunk of one car.
Speaker 5: Thing would be down on his rear leaf springs, like
Speaker 5: this floating steering that was barely on the road, and
Speaker 5: they'd put one guy in the driving that car, and
Speaker 5: everyone else would get in another car like fifty one
Speaker 5: hundred meters behind, and then caravan. And then even on
Speaker 5: long trips they'd stop and they'd rotate people out to
Speaker 5: who's the guy sitting with.
Speaker 2: The isotope in this long drive.
Speaker 4: Wow.
Speaker 5: So yeah, it was not healthy. But for the longest
Speaker 5: time they were doing things that was thought of as
Speaker 5: nothing short of magic, and people could not figure out
Speaker 5: they were bringing these just troves of documents that the
Speaker 5: Intel community in Poland and in Russia and elsewhere. They
Speaker 5: were sending the documents back like, how are you getting
Speaker 5: these documents? What the frigger? You guys are wizards, and yeah,
Speaker 5: they were just they were literally using electronic radiographic techniques
Speaker 5: to image our safe locks and get them open to
Speaker 5: see inside the safe fast.
Speaker 2: And then we figured we figured out something might be up.
Speaker 5: You know, they have their spies just as we have
Speaker 5: our spies elsewhere, and they were trying to source the
Speaker 5: isotopes through various scientific research labs and they had covered
Speaker 5: so why are you buying this cobalt? They would use
Speaker 5: cold or iridium one two, And our people figured out
Speaker 5: there said something something might be up with this?
Speaker 2: With this, I think they are they doing that? Could we?
Speaker 5: And we tried it and we said, oh we can, Yeah,
Speaker 5: this is actually a real thing. So we started making
Speaker 5: safes that would prevent that. And they basically we use
Speaker 5: plastic wheels inside of many of our safes and save
Speaker 5: the plastic wheels and lead shielding. And then they would
Speaker 5: just use different isotopes and there were different techniques that
Speaker 5: were even more dangerous. And yeah, I talk all about
Speaker 5: that in this presentation that I gave in North Carolina
Speaker 5: and in DC not too long ago.
Speaker 4: Are those online? Are those presentations online?
Speaker 2: They are okay, great, they are drop links for you
Speaker 2: and you can share them with others.
Speaker 4: Yeah, we'll put everything that he is talking about. I
Speaker 4: wrote down the name of well Division nine. I'll lays
Speaker 4: get the name of the book from you. You know
Speaker 4: now with Google Translate and you take a picture of
Speaker 4: a piece and read it.
Speaker 5: Like, yeah, I do have I do have a copy
Speaker 5: of the book that I doubt even buy the book
Speaker 5: electronically in Polish. And yeah, you can kind of machine
Speaker 5: translate it. So there's been this machine translated version that
Speaker 5: a bunch of my friends and I we kick it
Speaker 5: around in the intelligence world. It's it's a fascinating read.
Speaker 5: At least one person who saw this, who speaks very
Speaker 5: fluent Polish, he's like, man, I want to do I
Speaker 5: want to do a professional like proper translation.
Speaker 2: Yeah, And I was like, well, Tumash is still he's
Speaker 2: still a journalist. He's still in publication.
Speaker 5: Reach out to the author, tell him enough people, if
Speaker 5: enough people in the United States market, tell him we
Speaker 5: want to read this book, maybe he'll do it an
Speaker 5: official publication of it in.
Speaker 4: English for sure. Yeah, we should get in the publishing business.
Speaker 3: Dan as far as uh, some of the you know,
Speaker 3: things that get stolen. In that Smithsonian article I mentioned,
Speaker 3: you can sort of infer that we're probably trying to
Speaker 3: break into safes and Pakistani embassies for probably trying to
Speaker 3: figure out nuclear strategy stuff.
Speaker 4: That's just my inference from the article.
Speaker 3: There's another interesting report out there that says in nineteen
Speaker 3: fifty eight, the CIA actually accessed the Sputnik satellite that
Speaker 3: the Soviets had put into orbit, and they had access
Speaker 3: to it while it was out on world tour, and
Speaker 3: they had it for three hours to themselves to dismantle, examine, reassemble,
Speaker 3: and then, as you point out, clandestinely replace without anyone
Speaker 3: being the wiser. Interesting case of you know, breaking and
Speaker 3: entering for technological intelligence.
Speaker 2: I guess you could say, m Yeah, that's really cool.
Speaker 2: I never realized that that's really dope. What the heck
Speaker 2: with it? Kat, Were the Soviets just like going out
Speaker 2: to dinner and leaving it into their hotel? What the
Speaker 2: hell were they doing?
Speaker 3: Yeah, they were in the land of the Big p X,
Speaker 3: you know. So apparently it's in a book by Patrick J.
Speaker 3: McGarvey who wrote it a while back, but as far
Speaker 3: as what country that happened in that got redacted by
Speaker 3: the CIA, so we don't know.
Speaker 4: Fascinating, Okay, okay, I mean I imagine that they also
Speaker 4: didn't only take, but probably at times placed or exchanged. Sure, yeah,
Speaker 4: you know when it would it wouldn't be a bad
Speaker 4: idea to have people doing what you want them to
Speaker 4: do when they think it's what they're supposed to be doing.
Speaker 4: So how when did you is this sort of love
Speaker 4: the of the history of it kind of reason for
Speaker 4: you devent or or have you been studying like the
Speaker 4: history of the IC and safe cracking stuff like that
Speaker 4: for quite a while.
Speaker 5: It's something that has grown over time. For me, I
Speaker 5: definitely have done some reading in the past, but this, yeah,
Speaker 5: this latest because the book I mentioned from Thomas Avesovich
Speaker 5: that's only I believe from twenty twenty one or twenty
Speaker 5: twenty two, that was a pandemic read for me.
Speaker 4: Fascinating.
Speaker 3: So what else do you have for us on this topic?
Speaker 3: I've spilled some tea. You have some juicy details about
Speaker 3: intelligence services and safe cracking.
Speaker 2: Well, let's see, I mean, all the locks.
Speaker 5: That we use in the government space nowadays, and I
Speaker 5: touch on this in that same presentation. Anybody who's ever
Speaker 5: worked maybe for a dood contractor or something like that
Speaker 5: you made some of the listeners.
Speaker 2: Maybe be familiar with these.
Speaker 5: They're called electro mechanical safe locks nowadays, where it's not
Speaker 5: a keypad, it is a dial, but there's an electronic
Speaker 5: component in there and you actually have to spin it
Speaker 5: a number of time.
Speaker 2: Time is to spin it.
Speaker 5: Up and to charge it, and then a little numerical
Speaker 5: display will show these are These are safe locks made
Speaker 5: by nowadays they're made by Dorma Kaba.
Speaker 2: The Kaba company is huge.
Speaker 5: It was Kaba Moss for a long time because the
Speaker 5: originating company was Moss Hamilton. The entire story of how
Speaker 5: the Moss Hamilton Safe Company came about and how it
Speaker 5: was proposed as a standard, it gets into a lot
Speaker 5: of if you care about how your tax dollars get
Speaker 5: spent in this country, you know, the the FFL twenty
Speaker 5: seven to forty government lock standard was really pushed by
Speaker 5: a small group of people who designed They came up
Speaker 5: with a new idea for a lock, and then they
Speaker 5: used a lot of political influence to get it accepted
Speaker 5: as a new standard and then they were the that
Speaker 5: was the only lock that qualified under the standard.
Speaker 2: Right, and this for the longest time.
Speaker 5: If many people would be familiar with the name Sergeant
Speaker 5: and Greenleaf, I mean they're a huge name in the
Speaker 5: that safe in lockworld.
Speaker 4: We use those to lock up weapons in the army.
Speaker 5: Yeah, so Sergeant and green Leaf, like they had the
Speaker 5: entire safelock market covered, especially.
Speaker 2: For the government and the army.
Speaker 5: And then this new standard came out and started in
Speaker 5: green Leaf locks didn't comply because only one lock complied, right,
Speaker 5: the one that the designers of the standard made, and
Speaker 5: SNG spent all this effort trying to undermine and figure out, hey,
Speaker 5: how do we get either that product knocked off the
Speaker 5: qualifying products list or how do we get a product
Speaker 5: approved on the qualifying products list?
Speaker 2: And all this inside politicking.
Speaker 5: And inside baseball where these locks were being tested and
Speaker 5: evaluated and found to be faulty, they were found to
Speaker 5: be defeatable, and yeah, just a lot of a lot
Speaker 5: of like senators are involved, making phone calls and a
Speaker 5: lot of lawsuits. In fact, it comes back to Dave,
Speaker 5: Dave mccomi and his you know, his colleagues, Mike Madden
Speaker 5: Mike Madden was He's deal, so he was at Livermore.
Speaker 3: I know.
Speaker 5: I've spoken to Mike about this at length as well,
Speaker 5: and yeah, they they would They were proving, like with experiments,
Speaker 5: they were proving, Hey, this brand new wizbang lock is vulnerable.
Speaker 5: And they did a whole write up about it that
Speaker 5: was going to be published in the trade press, and
Speaker 5: it never saw the line of day because there was
Speaker 5: a lot of threats over lawsuits and and you know,
Speaker 5: to his credit, I really Dave's just a love I
Speaker 5: can't say enough nice things about mister Macomby day.
Speaker 2: Macomby's a great guy.
Speaker 5: He didn't want the main technician who did the was
Speaker 5: paid hired to do the research right. He didn't want
Speaker 5: him to experience ramifications, maybe have his clearance screwed around with,
Speaker 5: So that article was never was never put out. Now
Speaker 5: I've I've read the article, I've seen it. But yeah,
Speaker 5: for the longest time, this was just this rumor.
Speaker 2: Oh have you heard somebody used to mess with that
Speaker 2: exo lock? Nah, that didn't It happened.
Speaker 5: It absolutely happened, and none of these locks have ever
Speaker 5: been removed from the qualified products list. To this day,
Speaker 5: I still find the original original lock, the EXO seven
Speaker 5: it was called. It is still in the field on
Speaker 5: some containers props for long life span. Right, it's way
Speaker 5: beyond their originally anticipated duty cycle, but they're still out there.
Speaker 5: They're still in use locking up materials to this day.
Speaker 3: Well, it's interesting that that sort of reflects what you
Speaker 3: and the other instructors and the people at Defcon and
Speaker 3: black Hat teach on the hacker electronic digital side, that
Speaker 3: everyone claims their stuff is secure, but it really isn't
Speaker 3: and a lot of these companies kind of try to
Speaker 3: whitewash that or gloss over it and pretend it's not happening.
Speaker 3: And it's interesting to see the parallel in the physical
Speaker 3: security world as well.
Speaker 5: Yeah, it's I really do wish that more companies operated
Speaker 5: in the way that finally software and network security companies
Speaker 5: do now with you know, bug bounty programs and willingness
Speaker 5: to engage with researchers and do which would nowadays be
Speaker 5: called a coordinated disc closure where the researcher gets to
Speaker 5: put out a paper but only after the threat they
Speaker 5: have found has been mitigated properly, and they even oftentimes
Speaker 5: the researchers will work with these vendors that have these programs,
Speaker 5: they'll say, all right, let's collaborate, let's keep you under
Speaker 5: NDA until we get it fixed, and then you get
Speaker 5: the credit and the fame and the recognition for your
Speaker 5: hard work, and the public is made safer both in
Speaker 5: the short term by not disclosing it in a long
Speaker 5: term by everyone getting to upgrade and getting a new version.
Speaker 5: We don't see that nearly as much with the physical
Speaker 5: mechanical world, because you know, if a software package has
Speaker 5: a bug, they fix it and they say all right,
Speaker 5: download version fourteen point six. You download it on the internet,
Speaker 5: you click okay install. If a safe lock has found
Speaker 5: out a bug or I mean we saw this with
Speaker 5: hotel doors, right, Lots of things have been done in
Speaker 5: the hotel doors back when it was I think Cody
Speaker 5: Brocious did the ondity locks a long time ago with
Speaker 5: like a little like in Arduino that he made some
Speaker 5: code on. And then there were some kids very recently
Speaker 5: the Salto product the safe lock, which they call the
Speaker 5: unsafe lock when they did their Defcon presentation. These are
Speaker 5: products where the researchers work with some vendors, but like
Speaker 5: the fix is some technician going around to like every
Speaker 5: freaking door, and like installing a hardware flash, and hotels
Speaker 5: across the country like having to rotate out all of
Speaker 5: their keys, like their their card stock that they have
Speaker 5: a big box of Like, nope, you got to throw
Speaker 5: that card stock away.
Speaker 2: We need new silicon inside those room keys.
Speaker 5: So the lift is so much more to make an
Speaker 5: upgrade in the physical world that a lot of vendors
Speaker 5: still want to play the no.
Speaker 2: No, no, no, don't. I don't I didn't hear that.
Speaker 4: No, I don't want to know.
Speaker 2: There's a problem, right game.
Speaker 4: Well, I mean it's all it's all money. Then they don't.
Speaker 6: You know.
Speaker 4: It reminds me of sort of like vehicle you know,
Speaker 4: car recalls, vehicle recalls. You know, it's it's a numbers game.
Speaker 4: It's like how much money will this cost us, not
Speaker 4: how many people will we save? And so I imagine
Speaker 4: for you know, for a physical security company, it's the
Speaker 4: same thing. It's like, we don't care if you can
Speaker 4: defeat our locks as long as not everybody knows about it,
Speaker 4: right and and you know, uh, yeah, that's it's it's sad,
Speaker 4: it's it's scary. What what are some of the things,
Speaker 4: you know, it brings us back to go ahead, no, please,
Speaker 4: go ahead.
Speaker 5: It brings us back and recalling ed Norton. We mentioned
Speaker 5: Edward Norton in the movie The Score. He was also
Speaker 5: in uh, the movie adaptation of the Chuck Nax's book
Speaker 5: Fight Club. Right, there's that line he's talking to someone
Speaker 5: on an airplane in the movie and he says, I
Speaker 5: work for a major actuarial insurance firm, and.
Speaker 2: And he talks he's literally he talks about the formula.
Speaker 5: He's like, if there's a certain model of car and
Speaker 5: the brakes fail and people can die in a car. Right,
Speaker 5: we do the math of how many times it would happen,
Speaker 5: what's the average payout in a wrongful death lawsuit?
Speaker 2: And if it costs more than the Yeah, we're not
Speaker 2: going to recall the.
Speaker 4: Breaks, right, Yeah. What are some of the things, you know,
Speaker 4: you've talked about some of these locks that are still
Speaker 4: out there in service and hotel doors. What are some
Speaker 4: of the things that you see, whether it's government buildings
Speaker 4: or commercial buildings that aren't like a failing of the
Speaker 4: actual hardware, but that they do like consistently that defeats
Speaker 4: their own security. And then on the personal side, what do.
Speaker 4: What do you see people do with their own homes
Speaker 4: or whatever? That is also sort of this repeatable offense.
Speaker 2: Sure, two very different sort of answers.
Speaker 5: There one thing that I see a lot of, and
Speaker 5: all of my colleagues would probably also say this is
Speaker 5: sort of improper installation, or two different systems that are
Speaker 5: not ever tested together. For example, I will mention that
Speaker 5: I do a lot of things with fires and fire
Speaker 5: in life safety. If you're ever in a building, especially
Speaker 5: if you're in hotels, if you're in a corporate commercial space.
Speaker 5: The next time you're passing through a door and opening,
Speaker 5: if it's a kind of a heavy door, look at
Speaker 5: the hinge side of the doorframe and the door itself,
Speaker 5: the little butt side of the door, and you might
Speaker 5: see a metal or foil sticker. These are called door
Speaker 5: lay they're labeled door assemblies. These are for fire doors.
Speaker 5: A fire door if it has a certain endurance rating
Speaker 5: of forty five minutes, one hour, two hours. The entire
Speaker 5: assembly is tested together, so you'll have you name who's
Speaker 5: making the door, true door products and something. They make
Speaker 5: a whole door assembly, and then that gets sent off
Speaker 5: to a big testing lab. Warnock, Hersy or intertech or
Speaker 5: underwriter's lab something like that. They will test the entire
Speaker 5: door and the door frame and the hinge, all these
Speaker 5: components together, and they'll literally put it in a furnace
Speaker 5: and they'll hit it with a hose stream test to
Speaker 5: see if it bows or breaks or pops open. And
Speaker 5: then it is you know, blessed and approved. It gets
Speaker 5: a labeled rating. But that is how it is done
Speaker 5: this way with the fact, and you can make any
Speaker 5: modifications in the field. In fact, that's one of the
Speaker 5: things we inspect for and look for our field modifications.
Speaker 5: Did somebody add access control to this door? Did they
Speaker 5: punch a hole in the doorframe and then there's the
Speaker 5: door sensor in there.
Speaker 2: Well, now you violated the integrity of the doorframe. What
Speaker 2: are you doing?
Speaker 4: You can't.
Speaker 2: You have to use fire rated parts to that.
Speaker 5: So we see a lot of security systems where that
Speaker 5: door lock that you might have bought was designed properly,
Speaker 5: worked well, went through all of its testing, and then
Speaker 5: you install that.
Speaker 2: But then somebody else comes along, some.
Speaker 5: Integrators installing an access control panel, and then they are
Speaker 5: we're going to run wires, so we'll put an access
Speaker 5: control electronic door latch well, now you've taken away the
Speaker 5: strike plate that came with the door lock, and you're
Speaker 5: using a different type of strike mechan an electronics strike
Speaker 5: and those two components were never tested together. So installation
Speaker 5: of disparate products that were never tested together, they will
Speaker 5: not perform the way they were designed to perform.
Speaker 2: We see that all the time because and the world
Speaker 2: is a big complicated place. I get it.
Speaker 5: You know, your door hardware parts guy is not the
Speaker 5: one manufacturing your access control card technology system and the
Speaker 5: card system like NXP Semiconductor is not out there making
Speaker 5: door latches. So I understand the problems. But that's why
Speaker 5: we love it. We absolutely love it. When we've had
Speaker 5: people in RTA classes that aren't penetration team members.
Speaker 2: We've had integrators and installers come to our classes and
Speaker 2: they it's open their eyes, like, oh my god. We
Speaker 2: do that all the time.
Speaker 5: Yeah, we've been undermining the security to the customers, and
Speaker 5: you know, the customers insisting we want these parts because
Speaker 5: they look good, and you don't want to know, don't
Speaker 5: change out the other thing that will not the nice
Speaker 5: sat and finish keep that on the door, but then
Speaker 5: just change is this part of the door and now
Speaker 5: these guys come away from us like, man, I'm not
Speaker 5: gonna do that anymore.
Speaker 4: So.
Speaker 2: So and as far as what people do in a
Speaker 2: resident okay, go ahead, please.
Speaker 4: No, I was gonna say, so you're not like you.
Speaker 4: You're The example you gave was how it reduces it's
Speaker 4: it's longevity in a fire setting. But you're also saying
Speaker 4: that when they come in and you know, make a
Speaker 4: convenience change like an electric clock or an access panel
Speaker 4: or whatever, it also gives you an easier ways to
Speaker 4: beat those systems.
Speaker 5: Oh yeah, because they're installing the one like, well, I
Speaker 5: did my job correctly, but you don't realize you've installed
Speaker 5: it in a manner that it wasn't designed to be
Speaker 5: installed it or it was. Now it's trying to interact
Speaker 5: with a different system that you've never tested it on.
Speaker 5: So we'll say, oh wow, when you put those two
Speaker 5: two two great tastes, they don't taste great together because
Speaker 5: it's very vulnerable now that you bolted this onto that
Speaker 5: and it doesn't work the way you think it does.
Speaker 3: Yeah, I have Well, I guess one more question before
Speaker 3: we go on to viewer questions, which I'd like to
Speaker 3: ask since Thief came out in nineteen eighty one. What
Speaker 3: has made safe cracking more difficult? What has changed in
Speaker 3: this field in the last forty years or so that
Speaker 3: is making whether it's our intelligence service professionals or people
Speaker 3: like you helping out. You know, the government decommissioned safes.
Speaker 3: What are the big changes that have occurred over the
Speaker 3: last few decades.
Speaker 5: Oh, yeah, it's interesting, it'll tie back into the previous
Speaker 5: you'd asked one question we almost might have missed.
Speaker 2: He said, what can people do at home?
Speaker 5: And it is the same answer as what has changed
Speaker 5: with safe cracking? And it's the same answer that it's
Speaker 5: a call all the way back to I was saying.
Speaker 5: When we were younger, we had more free space to
Speaker 5: kind of play and roam.
Speaker 2: It's all electronic monitoring.
Speaker 5: Nowadays, you're not going to see beautiful, amazing graffiti on
Speaker 5: a subway car because kids in New York City in
Speaker 5: the seventies and eighties, I mean, they could sneak around
Speaker 5: in tunnels all night long and there may be would
Speaker 5: be one cop with a flashlight who might catch them. Nowadays,
Speaker 5: you try to go somewhere you don't belong. In Manhattan's
Speaker 5: MTA you're gonna be caught in five seconds. There's going
Speaker 5: to be electronic co there's cameras everywhere nowadays. What makes
Speaker 5: safe cracking hard the idea of like there was a
Speaker 5: famous robbery I even if I can find the article
Speaker 5: or any footage of it, there was literally like all
Speaker 5: the strong boxes are ripped out of this huge nest
Speaker 5: of safe deposit boxes inside of a vault.
Speaker 2: And I think it might have been in Brussels.
Speaker 5: It was a big financial and precious goods imporium and
Speaker 5: these these people had literally concrete cored through the wall
Speaker 5: and they spent the whole weekend rating this entire vault
Speaker 5: because there was no electronic monitoring, There were no cameras,
Speaker 5: there was no alarms down there because who would ever
Speaker 5: get in. Nowadays electronics have gotten so cheap, just electronic
Speaker 5: monitoring on everything.
Speaker 2: Now, I'm not saying you can't defeat it, it's different.
Speaker 2: I mean, we have a whole we.
Speaker 5: Have a whole intrusion detection defeats class at r TA right.
Speaker 4: Well, but if those gangs are doing it now, the
Speaker 4: gangs are doing it now too, with those portable man
Speaker 4: packs that they're getting off or whatever. But anyway, but but, but.
Speaker 2: Yes, they're monitoring yourself.
Speaker 5: Like if I can go up to your safe over
Speaker 5: the weekend, if you're away on a fishing trip or something,
Speaker 5: and I can just spend all weekend in your house
Speaker 5: working on your safe, something's wrong, right, Like, come on,
Speaker 5: use use a half decent electronic home monitoring solution telling
Speaker 5: you some pile of poo, like simply safe or something.
Speaker 2: Use something good.
Speaker 5: I like, Ubiquity is a pretty good brand. I don't
Speaker 5: really like Nest and ring Brim, and we're not going
Speaker 5: to get it bagging on or promoting any brands. I
Speaker 5: don't work for any these companies, don't.
Speaker 2: They don't.
Speaker 5: I don't have grudges of it. But using electronic monitoring
Speaker 5: and using it effectively, that's what makes everything so much harder.
Speaker 2: Electronic intrusion detection.
Speaker 4: Yeah, it's fascinating so for for people who might want
Speaker 4: to get into this field, right, whether because whether it's
Speaker 4: you know, doing what you do, uh sort of more
Speaker 4: in the civilian market with you know, obviously government stuff,
Speaker 4: or if they want to be a black bag guy
Speaker 4: or gal you know, working for the you know, FBI
Speaker 4: or the CIA or you know, local PD or whatever.
Speaker 4: Where do they start. What does that career path look like?
Speaker 4: There's not a military MS for it?
Speaker 2: So right, that is true. That is true.
Speaker 5: Although we're so self you hope you don't think I'm
Speaker 5: sounding self serving.
Speaker 2: I mentioned not at our training. Yes we are.
Speaker 5: We are inches away from I believe, being what is
Speaker 5: called cool program certified. The cool The cool program is
Speaker 5: people who are I think it's your last six months
Speaker 5: of service or recently exited uniform. There is budget available
Speaker 5: through the d D for people who want to train
Speaker 5: for a new career.
Speaker 4: That's fantastic.
Speaker 5: So coming to us or I think Blockmasters and Mark
Speaker 5: Baits MBA USA, I think they might also be Cool
Speaker 5: Program compliant. So if you're not in uniform, if you're
Speaker 5: just in the civilian land, that's fine. But it really
Speaker 5: is showing up and getting some base level of training,
Speaker 5: not only to know what the landscape is, but a
Speaker 5: lot of times and I have a whole blog post
Speaker 5: about this, I'll throw you that link as well. People
Speaker 5: like to bag on training. The training doesn't prove you
Speaker 5: actually know how to do a thing. I've seen more
Speaker 5: people with a certification that they didn't know squat.
Speaker 2: That's true.
Speaker 5: I've known many people with college degrees that aren't working
Speaker 5: in the field that they got a degree in. But
Speaker 5: you know what a certification, like with training and ultimately
Speaker 5: getting a certification represents to a lot of employers. It
Speaker 5: represents that you can sit the f down and just
Speaker 5: complet something, which is a very hard thing for a
Speaker 5: lot of people out there to do. Yes, a certification
Speaker 5: doesn't necessarily mean you're the best person at what the
Speaker 5: piece of paper says you can do, but it means
Speaker 5: you can see a task through to completion. In our
Speaker 5: scatterbrained ADHD world, a lot of times employers today just
Speaker 5: want to know are you a reliable person? Can you
Speaker 5: take a task and run with it and see it through?
Speaker 5: So I like to remind people of that when they say, man,
Speaker 5: is this certification going to actually help me out in
Speaker 5: my career? Yeah, it's much in the same way that
Speaker 5: you mentioned people in the service, right, A lot of
Speaker 5: times if an employer sees somebody, he said, oh, this
Speaker 5: person's former Army, this person was air Force, and they
Speaker 5: might give them like, let's bring that resume to the
Speaker 5: top of the pile. It's not because the job they're
Speaker 5: going to do has anything to do with you.
Speaker 2: Know, liberating some foreign bill. It has to do with
Speaker 2: the thing.
Speaker 5: This person knows how to like keep their heads straight
Speaker 5: in pressure. This person knows how to execute on tasks.
Speaker 2: This person can self manage.
Speaker 5: So giving employers a shorthand way of evaluating, Yeah, I'm
Speaker 5: not going to be a drag in your organization. I
Speaker 5: kind of can tie my own shoes and get myself
Speaker 5: to Friday without you having to babysit me. That's valuable
Speaker 5: to what a lot. That's what a lot of companies want.
Speaker 5: They want to be able to quickly ascertain. Are you
Speaker 5: a person that's going to bring value to my org?
Speaker 4: Right?
Speaker 2: Right?
Speaker 4: If you got the Patreon questions, absolutely, And I apologize
Speaker 4: for those text rings. It's I had taken my phone
Speaker 4: off airplane modes like a lot.
Speaker 2: I didn't hear them at all.
Speaker 4: It's all okay, great, great, great, let's see her. Let
Speaker 4: me take my phone off.
Speaker 2: You're getting these live and we've been live streaming this
Speaker 2: whole time for.
Speaker 3: The Patreon folks people watching.
Speaker 4: We used to, man, I feel.
Speaker 2: So bad that we were. We were a little bit
Speaker 2: off kilter on getting the zoom link work.
Speaker 3: And no, it's more my fault than anything.
Speaker 4: Okay, so matt As, thank you much. Really stoked to
Speaker 4: see Devian all on a guess huge in the pent
Speaker 4: testing community. Question for the guests, what is one tool
Speaker 4: that you see people include in their physical pen test
Speaker 4: kit that is overrated and should probably be left at home?
Speaker 4: And what is one tool you always bring with you
Speaker 4: on an engagement?
Speaker 2: Oh? I love the first question.
Speaker 5: I want to give more brain space to that because
Speaker 5: people buy so much stuff and keep adding it to
Speaker 5: their kit and adding it to their kit. And yeah,
Speaker 5: you know, you see the person like my daily pocket carry,
Speaker 5: then that becomes their sort of sling bag, right, and
Speaker 5: then that becomes a backpack right.
Speaker 2: Before you know it. You're like, it's not even daily
Speaker 2: carrying or what do you what do you freaking do
Speaker 2: and you're carrying a freaking rut bag? What would I say?
Speaker 2: You know what I'm gonna go. Here's what I'm gonna do.
Speaker 5: I'm actually going to pull up, briefly, my own you know,
Speaker 5: I'm gonna pull up Red Team Tools, which is my
Speaker 5: own catalog, and I'm going to look through my own
Speaker 5: catalog about something of like, this is the last thing
Speaker 5: you should possibly purchase from us.
Speaker 2: Bump cocade.
Speaker 5: Some of these are all right, it's probably it might
Speaker 5: be an electronic tool. Yeah, yeah, you know what I
Speaker 5: will say, it's a it's a cool it's a cool thing.
Speaker 5: But we have a couple of tools designed for pin
Speaker 5: pad hacking. There are people that say you can use
Speaker 5: thermal cameras to like look at a pin pad right
Speaker 5: after somebody has entered a pin to see where their
Speaker 5: fingers were touching. We actually, I make a kit of
Speaker 5: UV powder, so you dust the pin and you come
Speaker 5: back later with a UV light and you can see
Speaker 5: where the pin pad was touched.
Speaker 2: I know, we sell them like I make these like.
Speaker 5: My that's Hollywood shit, man, Come on, Like, I'm not
Speaker 5: saying it has no purpose. And in fact, if you
Speaker 5: have an electronics safe, that's interesting because that's probably one code,
Speaker 5: or an alarm panel, that's probably one code that gets entered.
Speaker 5: But a door, an electronic keypad access door where there's
Speaker 5: probably lots of people with different codes, that's not gonna help.
Speaker 2: Come on, you're not going to get there.
Speaker 5: But yeah, I have used it on an electronics safe
Speaker 5: in an executive's office once because I was able to see.
Speaker 2: Which numbers they had touched.
Speaker 5: And I came back a week later, and I didn't
Speaker 5: actually open the safe worn off, but I said, is
Speaker 5: that are these the digits of your combination. I didn't
Speaker 5: even tell him what the digits the right order. He
Speaker 5: was freaked out that I actually knew it at all.
Speaker 5: But yeah, you don't need you don't need that shit
Speaker 5: by that after you bought everything else, but don't carry
Speaker 5: your daily carry and the tool that everyone should.
Speaker 2: Have on them at all times.
Speaker 5: Yeah, two more answer the best the best two things available.
Speaker 5: Traveler hook which is used for getting latches on doors,
Speaker 5: and it's called an underdoor tool, and they both have
Speaker 5: their pros and cons. I'll tell you a traveler hook
Speaker 5: I got my I got my wallet.
Speaker 2: Right here.
Speaker 5: In my wallet is a small skeletonized version of a
Speaker 5: traveler hook. It doesn't have a big chonky handle. My
Speaker 5: buddy in Scotland makes these. He calls these the skeleton hook.
Speaker 5: But it's this is just you saw. I just pulled
Speaker 5: it out of my wallet and it just I'll get
Speaker 5: doors open with this all the time.
Speaker 2: The other one that's hard, I mean the underdoor tool.
Speaker 5: If anyone out there has seen an underdoor tool, they're
Speaker 5: devastatingly effective, not easy to carry around.
Speaker 2: They're big.
Speaker 5: Now I happen to have an underdoor tool as well.
Speaker 5: It's in my belt because I have. I'm there's a
Speaker 5: whole video. It's a tiny video I talked about where
Speaker 5: I literally found a belt manufacturer that would do exactly
Speaker 5: what I wanted and make a belt with a long
Speaker 5: cavity in it. I tried money belts, but they weren't
Speaker 5: they weren't enough space. But yeah, we have the We
Speaker 5: have underdoor tools that you can whip out of a belt.
Speaker 5: It's as good as a big commercial underdoor tool. No,
Speaker 5: but if I could give that's my gift to the world.
Speaker 5: I want to give everyone the ability to have an
Speaker 5: underdoor tool on them at all times if they want it.
Speaker 5: And I always travel with mine. Traveler hook a undoor
Speaker 5: tool for remedies for.
Speaker 4: People who might not know what those are. Can you
Speaker 4: give us a real quick brief description of what each does?
Speaker 2: Yeh sure?
Speaker 5: So the traveler hook, as if anyone was watching the
Speaker 5: video part of this, it's a small tool with a
Speaker 5: tiny probe sticking off the end of it. It's a
Speaker 5: tiny right angle hook. If you want a really cheap
Speaker 5: version of them. You can grab some o ring picks
Speaker 5: at your local hazard fart or home desk spot or
Speaker 5: something like that. Those are going to be cheaper steel,
Speaker 5: and they're going to be too thick to.
Speaker 2: I think the shafts on those are too thick to.
Speaker 2: That's why if you want to get a nice version,
Speaker 2: you get like a proper traveler hook from US or
Speaker 2: from Lockmaster sells them. I think Mark Baits sells them.
Speaker 5: But yeah, you reach into a door jam and you
Speaker 5: can manipulate the on the door. If the latch is
Speaker 5: not dead latching correctly, which is a very perennial problem,
Speaker 5: you can slip many doors open with a traveler rook
Speaker 5: an underdoor tool.
Speaker 2: As it sounds it reaches beneath a door.
Speaker 5: But the idea is modern building code, ADA code, Fire code.
Speaker 2: All these various codes require egress is always allowed.
Speaker 5: Free egress from a building should never be denied or impeded,
Speaker 5: so you can have all the locks and access control
Speaker 5: you want on the outside of a door. If someone's
Speaker 5: inside trying to leave, I mean there's rules, there's laws
Speaker 5: and rules around this. It's single motion, a single pushing
Speaker 5: or twisting motion on a door handle. There's actually for
Speaker 5: ada reasons. It's poundage of pressure, how many foot pounds
Speaker 5: and inch pounds of so forth of torque and push,
Speaker 5: so it's very light pressure on the inside of a
Speaker 5: door shall cause the door to unlock.
Speaker 2: On the operable part.
Speaker 5: An underdoor tool is a long rod that reaches up
Speaker 5: under the door, swings back towards the door, and you
Speaker 5: yank down on a cord and you're trying to hit
Speaker 5: the handle, the inside handle, but you yourself are on the
Speaker 5: outside of the door. And if you can trip that,
Speaker 5: what's called the operable part of the door. Meaningfully, it's
Speaker 5: a lever style handle that will trigger the door to release.
Speaker 5: And if you have a long enough rod and a
Speaker 5: string on the end of it, and you know how
Speaker 5: to use it, you can pop open the vast majority
Speaker 5: of commercial doors in all the buildings that you travel.
Speaker 2: Through all the time.
Speaker 4: Sounds much easier to use than a wire coat hangar
Speaker 4: undone with five point fifty core tied around the top
Speaker 4: of it.
Speaker 2: I've seen people do it, though, you know, you make
Speaker 2: use of what you got. Provis adaptance would come.
Speaker 4: Yeah, for sure. And then the other question was, thank
Speaker 4: you very much. One question for him, how was how
Speaker 4: has physical pen testing evolved in the age of ubiquitous
Speaker 4: technical surveillance, where the opportunity for traps back by all
Speaker 4: kinds of sensors covering the entire spectrum are widely available
Speaker 4: in easy disguise. As a defender, I actually have the
Speaker 4: impression that it wouldn't be overly difficult to design a
Speaker 4: room designed to hold secrets that would be a nightmare
Speaker 4: to try to approach covertly. Is that notion particularly off
Speaker 4: base in your opinion experience? And I'm also just curious
Speaker 4: to hear your opinion on how traps have evolved from
Speaker 4: the days of analog only solutions like matchstick in the doorway,
Speaker 4: you know, a piece of hair on the you know,
Speaker 4: resting something.
Speaker 5: Absolutely true, absolutely true. And in fact, if you go
Speaker 5: to these major trade shows nowadays, for example, Millipole, the
Speaker 5: Military and Police Expo is one ISC, the C trade show,
Speaker 5: the Security Controls trade shows, I C West and IIC East.
Speaker 5: We're always out IC West. Out here in Vegas, we're
Speaker 5: always out I. You'll see loads of vendors. Now, I mean,
Speaker 5: AI is a hot topic, so they're shoving AI into everything. Sure,
Speaker 5: but the idea is if you put enough camera coverage,
Speaker 5: just visual camera coverage in a space. We are just
Speaker 5: about at the point where you can, in theory, give
Speaker 5: us a technological solution a list of people who belong
Speaker 5: in the building. Now you're giving away a lot of
Speaker 5: your biometric data to an employer, possibly a third party
Speaker 5: that the employer has hired, So take that as you will.
Speaker 5: And there's a lot there's a lot of cost in
Speaker 5: installing all this, and there's probably a subscription plan involved.
Speaker 5: But there are schools now and I don't know how
Speaker 5: I feel about this with kids and all of our
Speaker 5: kids biometric data being saved by some firm that doesn't
Speaker 5: have their best interest at hart probably, But there are
Speaker 5: schools where if anybody shows up in the school and
Speaker 5: they're not in like the face database, it throws an
Speaker 5: alert on a screen and the resource officer or some
Speaker 5: teacher gets sent down that hallway and it's like, Hi,
Speaker 5: what are you doing here?
Speaker 2: Are you here to pick somebody up? How did you
Speaker 2: get in?
Speaker 5: It is absolutely a huge challenge, but that's only as
Speaker 5: good as the systems that are employing it.
Speaker 2: We've seen that a can hallucinate.
Speaker 5: We've seen that something I remember there were early days
Speaker 5: of facial recognition somebody. Basically there was a man with
Speaker 5: a beard and he wore long like shoulder duster earrings.
Speaker 5: So the fact that he was very mask presenting. He
Speaker 5: had masculine facial features, but he was wearing something accessories
Speaker 5: that were very fem coded.
Speaker 2: The system completely didn't know what to make of it.
Speaker 5: It broke on like the line the first line of
Speaker 5: code couldn't classify him by gender, and like the system
Speaker 5: just failed. So we're probably going to continue to see
Speaker 5: oddities and edge cases like that, which brings us back
Speaker 5: to the importance of testing. All these vendors out there
Speaker 5: should be engaging the hacker community and the researcher community
Speaker 5: and inviting them to test these systems, because it just
Speaker 5: takes one person to say, what if I wear my
Speaker 5: hat and I put a really really freaking bright ir
Speaker 5: led under the brim of the hat, and people did
Speaker 5: that to defeat facial recognition for years. You're walking along
Speaker 5: the street and that just you don't your naked eye
Speaker 5: just sees a person, but all the cameras just saw
Speaker 5: a huge white blob over the It was just blew
Speaker 5: out the levels of the camera. The automatic game control
Speaker 5: of the camera didn't work.
Speaker 4: Yeah, fascinating. I got a couple others here.
Speaker 3: Alex asks, how did you get to know Carl in
Speaker 3: the in Range crew.
Speaker 5: Hell yeah, I just saw Carl. I was just at
Speaker 5: High Desert Brutality. I just flew back from Idaho right
Speaker 5: like yesterday. So Carl also, Carl Cassard an amazing person,
Speaker 5: wonderful human, smart guy. He is not just a firearms person.
Speaker 5: I mean he came from the acker world. He was
Speaker 5: in the tech world. He was a SIS admin and
Speaker 5: a network guy for years. That's how he made his bones.
Speaker 2: He was around.
Speaker 5: I mean, he'll tell stories back when Operation Sun Devil
Speaker 5: was a big hacker crackdown and he witnessed all of
Speaker 5: that go down, and he remembers running and securing systems
Speaker 5: at the time. So Carl was aware of def Con
Speaker 5: and he had heard of this thing that I ran
Speaker 5: with firearms for years. I ran was called the Deafcon Shoot.
Speaker 5: Still exists. Other people run it now. I've turned it
Speaker 5: over to them after a decade, and he and a
Speaker 5: former colleague of his, they came out to the deaf
Speaker 5: Coon Shoot just to see what it was about.
Speaker 2: They said, Hey, it's in Vegas. We're in Arizona. Let's
Speaker 2: just drive up.
Speaker 5: And he and I met at Defcon and I instantly said, oh,
Speaker 5: you're like, you're a cool guy. You're injured this stuff.
Speaker 5: I'm into what you're into. Let's keep talking. And we
Speaker 5: just kept coming to each other's events. Ever since then,
Speaker 5: he's come back to deaf Con several times. I've gone
Speaker 5: to his firearms events again. Show notes click down below.
Speaker 5: I'm sure you'll drop a link to in Range TV.
Speaker 5: It's one of the very very few people in the
Speaker 5: firearms space that is not monetized and they're not doing
Speaker 5: a lot of corporate shilling. Most influencers in the gun world,
Speaker 5: there's a lot of there's a lot of money and
Speaker 5: pay for play reviews going on, and Carl's out there
Speaker 5: just in his own backyard in Arizona doing mud tests
Speaker 5: with a bucket of water in the Arizona sand and saying, Yep,
Speaker 5: this gun failed.
Speaker 2: Sorry, I don't know what to tell you, MANUF sure
Speaker 2: send it to me. I'm sending it to They'll make
Speaker 2: a change, they'll send me another one.
Speaker 5: So he's a very honest, very upstanding guy, and yeah,
Speaker 5: we've been friends forever. I visit him, I visit him
Speaker 5: at his place. We travel places together. He's he's one
Speaker 5: of my favorite people.
Speaker 2: Uh.
Speaker 3: One last one from m Corbin. He asks, what is
Speaker 3: your favorite fiction author?
Speaker 2: Favorite fictional author.
Speaker 3: The writer of fiction, not actual fictional author. Yes, yes, yes,
Speaker 3: Douglas Adams is going to be up there.
Speaker 5: I find that the Hitchhiker's Guys series and the lesser
Speaker 5: known works the Dirt Chanley's Detective Agency and such.
Speaker 2: Uh Dirt, you know, the Douglas Adams books.
Speaker 5: They have this wonderful lightheartedness to them, a spirit of
Speaker 5: adventure and positivity that's just full of warmth. The world
Speaker 5: is a lesser place without Douglas Adams around. My wife
Speaker 5: would mention, you know, things like Pratchett and other sci
Speaker 5: fi authors that she you know, she's a much bigger
Speaker 5: fan of and tries to get me involved. I tried
Speaker 5: to watch Dune recently. I tried to, you know, I
Speaker 5: watched The Lord of the Rings with her. I'm I
Speaker 5: understand Tolkien's amazing world building, but there's something about the
Speaker 5: lightheartedness and the smile that I will reread.
Speaker 2: Adams's work to this day.
Speaker 4: Yeah.
Speaker 5: I used to really love Richard Morgan, The British author
Speaker 5: Richard Morgan British Scottish British Richard Morgan, I wrote the
Speaker 5: Altered Carbon series. Yeah, yeah, not not the most progressive
Speaker 5: views on some issues that are very dear to people
Speaker 5: in my life.
Speaker 2: I have a trans daughter, so like, no, don't, don't, don't,
Speaker 2: don't promote Richard Morgan as much anymore. I think Douglas
Speaker 2: Adams would have been fine with her though, So yeah,
Speaker 2: Douglas Adams gets my vote.
Speaker 4: Yeah.
Speaker 8: I And last thing, I guess, Deviant Dave, do you
Speaker 8: have anything before we what Deviant plug his company and
Speaker 8: website and.
Speaker 4: Not at all. Would just like to remind you, like
Speaker 4: when we say we're out of you don't mind hanging out.
Speaker 4: And if you're watching this recorded, you could be watching
Speaker 4: this live if you're a Patreon subscriber and we're going
Speaker 4: to do a teamhouse after dark, just a fun little
Speaker 4: story or whatever for our patron subscribers afterwards. But please
Speaker 4: go ahead, Jack.
Speaker 3: So Devian tell people out there where they can go
Speaker 3: to procure your services if they want you to break
Speaker 3: into their home place of employment.
Speaker 4: I bust open a's safe.
Speaker 3: Tell them about the classes that you offer and where
Speaker 3: they can find you guys.
Speaker 5: Sure, so yes, on the internet, I am Devian Olaf
Speaker 5: spelled not at all like it sounds. So yeah, you'll
Speaker 5: see my name in the episode. But I'm on all
Speaker 5: of the things as my user name, so YouTube. But
Speaker 5: I'm not on Twitter. No one's on Twitter anymore. But
Speaker 5: you know blue Sky mast it on Instagram read it.
Speaker 2: I have a GitHub.
Speaker 5: The professional side of things, my one company is called
Speaker 5: the core Group, so Bobbic and I have been running
Speaker 5: the core Group since twenty ten.
Speaker 2: We're at the core Group dot net. That's if you
Speaker 2: want us to break in, if you want to learn
Speaker 2: how to break in, it's going to be a Red
Speaker 2: Team Alliance.
Speaker 5: So Redteamalliance dot com. This I'm literally sitting the reason
Speaker 5: I'm in such a baar weird white box. We got
Speaker 5: the keys yesterday morning to our new building in Vegas.
Speaker 5: We're all out here moving in, so all the teams downstairs,
Speaker 5: the moving trucks have been rolling all day. Hopefully you
Speaker 5: haven't heard the garage doors rolling up and down outside.
Speaker 2: Yeah.
Speaker 5: So Redteamalliance dot com. Our full training calendar is online.
Speaker 5: We have our Vegas facility. We have our facility in
Speaker 5: Virginia near DC. We have classes in Australia at Europe
Speaker 5: as well if you want to buy stuff. You know,
Speaker 5: I never like mention in our retail catalog. I feel
Speaker 5: like such a shill. It's not my I wouldn't say
Speaker 5: it on my channels on social media. But Red Team
Speaker 5: Tools all the equipment and gear that I make and
Speaker 5: design and have changed over the years. Here's a fun one.
Speaker 5: This was a product that literally existed and no longer does.
Speaker 5: And I bring things back from the dead. So we
Speaker 5: have these kind of in people's kits in the field.
Speaker 5: You just this is a fence climber.
Speaker 2: You stick it through a fence, you drop it and
Speaker 2: it hangs and you can go up one side down
Speaker 2: the other. You get a couple of these in your pocket,
Speaker 2: and you.
Speaker 4: Know, eight ballot you name.
Speaker 5: However, how the fences are. You're up and over in
Speaker 5: no time, even my fat ass. So that's all on
Speaker 5: Red Team Tools dot com. You always yeah, the board
Speaker 5: group in Red Team Alliance. So the most useful.
Speaker 4: Fantastic I was going to say that you always need
Speaker 4: something like Jack to go over first though, to lay
Speaker 4: down on the concertina at the top, so then you
Speaker 4: go up climb over them.
Speaker 2: Harder to do all that nowadays.
Speaker 5: I mean, we have friends at Magnosphere who the fence
Speaker 5: sensor technology. The shake sensors are getting really subtle, and
Speaker 5: I could I even I did an experiment where I said,
Speaker 5: I wonder if it would detect going over the fence.
Speaker 5: I bet it will, And the guy was like, it's
Speaker 5: going to detect you putting it on the and sure enough.
Speaker 2: Yeah, we watched.
Speaker 5: You can watch the little line go up on their graph.
Speaker 5: He's like, yeah, you're just touching the fence.
Speaker 6: Was enough.
Speaker 2: You're not getting over that.
Speaker 4: That's amazing. That's amazing. Yeah, So definitely check out Devian's
Speaker 4: the classes, the company and the videos. Like everything on
Speaker 4: YouTube is just fantastic. So I highly recommend people track
Speaker 4: you down and watch all of that. Absolutely, thank you.
Speaker 5: A lot of I mean my channel now must I've
Speaker 5: been on YouTube since two thousand and nine. There's a
Speaker 5: lot of crap on there, but the long I find
Speaker 5: a lot of people like the long form ste so
Speaker 5: my lectures when I've actually given presentations. There's maybe a
Speaker 5: dozen or more hour long videos on my channel that's
Speaker 5: all my professional.
Speaker 4: Talks, and I think it's a lot of fun, you know,
Speaker 4: you talked in the beginning about you know, kids not
Speaker 4: having space anymore, and like I remember when I was
Speaker 4: maybe like in junior high, like breaking into a school
Speaker 4: over the summer, like going in through the top, and
Speaker 4: we weren't destroying anything, we weren't stealing anything. It was
Speaker 4: just the thrill of being able to get in, right
Speaker 4: and you're in, and like you're in. Yeah, and you still,
Speaker 4: like a lot of your videos, you still have that
Speaker 4: thrill of discovery, like when you're when you're presented with
Speaker 4: a new challenge, a new technology, a new type of
Speaker 4: door sensor, you know, you know, like because it has
Speaker 4: to open from one side and put in gas or
Speaker 4: putting blowing up a balloon or whatever on the other
Speaker 4: side of the door. Like there's still a lot of that,
Speaker 4: I don't know, like that that sense, that childlike sense
Speaker 4: of exploration, like oh, let's let's here's a new puzzle,
Speaker 4: let's solve it. Absolutely yeah, all right, guys. Uh so
Speaker 4: we will see all of you next time. Thank you
Speaker 4: for joining us, Thank you deviant And you can find
Speaker 4: all the links down the description that we mentioned on
Speaker 4: the show, and uh for our Patreon subscribers, stick around
Speaker 4: because there's a little bit more. It's gonna get spicy.
Speaker 4: All right, I'm gonna leave it running.
Speaker 3: D can cut the film, Oh right, right, because we can,
Speaker 3: we can roll.
Speaker 4: Right, that's right, that's right, because we're not live for anybody.
Speaker 4: But patron, Uh, do you do you have I know,
Speaker 4: I kind of put you on a spot to you
Speaker 4: but we're still rolling. We're still live to the patron.
Speaker 4: But uh, do you do you have something in mind?
Speaker 8: Uh?
Speaker 4: A story or a vignette or anything.
Speaker 2: Oh, a story from from my end?
Speaker 4: Yeah, so, and I said, it can be you know,
Speaker 4: it could be something that a time went bad, a
Speaker 4: time went really good, a time something weird happened. Yeah,
Speaker 4: weirdest things.
Speaker 2: I mean, there's a story I've I've told once or twice.
Speaker 5: But my one of my favorite jobs was a job
Speaker 5: we completely had no success and it was a small
Speaker 5: company in the in the middle of America. It was
Speaker 5: a Middle America Nowheresville. And some people say, oh, you
Speaker 5: know these po dunk town that you're gonna put one
Speaker 5: over on those roobs. I mean, no one really says
Speaker 5: something rude, but uh, there's there's a certain kind of
Speaker 5: thinking that says, well, small companies, you know, these people,
Speaker 5: they're not They're not going to have sophisticated security systems.
Speaker 2: And they didn't. They didn't have a lot of big budget, they.
Speaker 5: Didn't have all the the whiz bang stuff that you
Speaker 5: see at the trade shows. What they had was a
Speaker 5: dedicated team of staff, many of whom had worked there
Speaker 5: for decades, and they just they had emotional investment in
Speaker 5: what they were doing. This was it was an agribusiness essentially,
Speaker 5: so they were American food supply right like this is
Speaker 5: it's I would consider critical to our nation's health and
Speaker 5: well being. I was very hopeful that their security would
Speaker 5: be robust, but it was, and where I wasn't expecting.
Speaker 5: We came out there case the joint, did all our
Speaker 5: usual recon had our cover stories. We said, all right,
Speaker 5: let's find the local utility companies in town. We made badges, outfits,
Speaker 5: you name it in case we were on site getting questioned.
Speaker 5: So we were, you know, because of being a utility
Speaker 5: company worker, you can kind of be on the buildings
Speaker 5: around the grounds and no one would oh, that guy's
Speaker 5: doing the he's checking out, he's you're spray painting some
Speaker 5: marks in the ground a little bit.
Speaker 2: So we did all this research.
Speaker 5: We found a few doors that were a little bit
Speaker 5: of jar and we had somebody all right, we come
Speaker 5: up with an attack chain. We're gonna come in on
Speaker 5: Sunday morning. Everyone's at church or watching football. We were
Speaker 5: on site, walking around the premises and again looking like technicians. Right,
Speaker 5: we were in this building. There's a multi building complex.
Speaker 3: I remember.
Speaker 5: We're in a building for maybe half an hour forty
Speaker 5: five minutes tops, and somebody said on our team and say, hey,
Speaker 5: there's a car in the parking lot that wasn't there earlier.
Speaker 2: We look out, sure enough, Yeah there's a car. What's that?
Speaker 5: And we later said, do you see who's that guy
Speaker 5: looking at it? There's a guy going from building to
Speaker 5: clearly going building to building, not a security guard, just
Speaker 5: to just a dude whose badge worked.
Speaker 2: He said, that's freaking weird. And later he came and
Speaker 2: found it.
Speaker 5: He found us in one of the buildings, in one
Speaker 5: of the offices, and he said, hey, you know, what
Speaker 5: are you guys doing in here again? So we're from
Speaker 5: such and such Telecom. We were sent here. We did
Speaker 5: some work at your Wyoming office. He said, we're here
Speaker 5: at the Kentucky office.
Speaker 6: Now.
Speaker 2: He said, no, I would have heard about that. Who
Speaker 2: sent you from Wyoming?
Speaker 5: We knew Nately said, oh, well, Keith is the plant
Speaker 5: manager over there, he does the IT infrastructure. No, I
Speaker 5: don't know if Keith what I could call Keith and
Speaker 5: find out. This guy was having none of it, and
Speaker 5: eventually we had to We had to produce a you know,
Speaker 5: always carrying a letter that says, look, we were hired
Speaker 5: by this guy. The CEO knows were here, the owner
Speaker 5: knows we're here, and he's like, yep, yeah, there was
Speaker 5: an odor to this situation.
Speaker 2: I didn't like it. We said, well, are you working today, sir?
Speaker 2: He said no. I was driving through town.
Speaker 5: He was literally driving down Main Street and he looked
Speaker 5: at the parking lot and just driving by the buildings,
Speaker 5: he saw one of our team in the parking lot.
Speaker 5: He said, I don't recognize that guy. He did a
Speaker 5: k turn, came back up Main.
Speaker 2: Street and he said, then saw your guy badge into
Speaker 2: a building. And I said, I still I don't like this.
Speaker 2: And I said, wait a minute. You saw on your
Speaker 2: freaking day off a person badge you with a working badge,
Speaker 2: and you still didn't He's like, no, I didn't like it.
Speaker 2: Some didn't like sudden didn't feel right.
Speaker 5: I know companies where you could walk in and say, hi,
Speaker 5: I'm here to steal everything, and the employees would say, yeah,
Speaker 5: f this company. They don't care about me anyway, right
Speaker 5: right care, Yeah they give a crap.
Speaker 2: But this guy, I mean, he had been working there
Speaker 2: for probably thirty forty years. Yeah, he knew like he
Speaker 2: knew the owners. They went bowling and say he's liked.
Speaker 5: No, he just had emotional investment, as did everyone at
Speaker 5: this company. We were on our walk through the day
Speaker 5: after we're on Monday, escort it around and at one
Speaker 5: point our escort, you know, the co owner of the company,
Speaker 5: his son. He left us alone to get something, and
Speaker 5: a woman was like, what are you doing in this
Speaker 5: wing of the building.
Speaker 2: We said, oh, you know, Frank is letting us say.
Speaker 2: She says, like, Frank's not here. Where's Frank?
Speaker 5: You don't belong here. Come to the front with me
Speaker 5: right now. And she had just been working there for you. Again,
Speaker 5: she had been at the same desk for the same
Speaker 5: many decades. There's a real lesson there and investing in
Speaker 5: your people. I don't just mean give pizza Fridays, right,
Speaker 5: I mean actually give real raises, take a real interest.
Speaker 5: Are people satisfied with their job? Do they care about
Speaker 5: what you're doing? That's what saved this company from everything
Speaker 5: we tried to do to them.
Speaker 4: Okay, I want to ask you know, I don't want
Speaker 4: to keep you too long, but I want to ask
Speaker 4: either for a time you were horrified by how easy
Speaker 4: something important was that shouldn't have been easy, or about
Speaker 4: the biggest ass chewing you ever saw because something was easy.
Speaker 5: I was really sad to learn of this was a
Speaker 5: biomedical research facility.
Speaker 2: And ultimately they had spent a time.
Speaker 5: I mean they had money coming out their years, right,
Speaker 5: they had spent so much money on all their security systems,
Speaker 5: but they didn't invest in a decent like badge credential technology.
Speaker 5: They were still using the most outmoded, outdated hid pros credentials,
Speaker 5: which had been around, you know, thirty years at this point,
Speaker 5: more than that forty years probably at this point, the
Speaker 5: original hip rocks and it's the most clonable badge imaginable.
Speaker 5: We ultimately it was hard to clone badges. We couldn't
Speaker 5: really get to the employees. They weren't around. It was
Speaker 5: a very buttoned up, very tight building, but one of
Speaker 5: our staff went in. One of our team went in
Speaker 5: and interacted with the guards in the front lobby and
Speaker 5: he was just bs and with them, and there's again
Speaker 5: we talked about this in training. We had a long
Speaker 5: range reader in a laptop bag and if you got
Speaker 5: close enough to someone's badge, you could grab it.
Speaker 2: You could because.
Speaker 5: There's no encryption on the badges. You just had to
Speaker 5: brush past the badge. And he was able to get
Speaker 5: past one of the guards. And there's a longer version
Speaker 5: of the story that I've telled us, but eventually he
Speaker 5: gets near a guard, gets the guy's badge, and then
Speaker 5: we just cloned it into We just got in, and
Speaker 5: then we came in the next night midnight shift. There
Speaker 5: was a big movie premiere. It was like the new
Speaker 5: Star Wars that was coming out, like the episode Phantom
Speaker 5: Menace or whatever was coming out a long time ago story,
Speaker 5: but we were able to use these We just got
Speaker 5: it everywhere at that point. And the lesson we later
Speaker 5: learned and it can't go was two how it's not
Speaker 5: always your fought's not always you can control the badges.
Speaker 5: So this building that they were renting was owned by
Speaker 5: a huge property management company, and they insisted, like, here's
Speaker 5: the badges for the building.
Speaker 2: This is the badge system right now.
Speaker 5: They had other badges they could have used, but the
Speaker 5: property management company made it such a pain in the ass.
Speaker 2: They just said, no, we're just going to go with
Speaker 2: the badges they find. We're not going to go through
Speaker 2: all the legal hoops and give you copies of badges.
Speaker 5: So they were locked in by some weird rental agreement.
Speaker 5: But the sad part is that all that entire guard crew,
Speaker 5: I won't say it got fired. They still had jobs,
Speaker 5: but they lost that contract. Like the guards were all
Speaker 5: cycled out, and that was part of the with the executives.
Speaker 2: I can't believe the guards let you get close to that.
Speaker 2: I said, come on, man, who's going to think that somebody? Right?
Speaker 2: You know, we had a guy who you had to talk.
Speaker 5: I said, if you had kept those guards, that would
Speaker 5: be trial by fire for them. That would they would
Speaker 5: be way more hardened against this kind of attack, and
Speaker 5: they'd be way more poised to say, hey, I'm not
Speaker 5: going to keep my badge right in front of me
Speaker 5: while it's visible.
Speaker 2: And you know, I think it was the wrong move.
Speaker 5: I think they should that's that you want the person
Speaker 5: who got caught in a stumble if they're willing to
Speaker 5: learn from it and recover and get better.
Speaker 4: Especially if they didn't even know that technology existed. Like
Speaker 4: they're they're security guards, right, They're they're not like FBI,
Speaker 4: They're not FBI.
Speaker 2: You know.
Speaker 4: It's yeah, yeah, it's unfortunate. Devian. Thank you, Thank you
Speaker 4: very much. We really we appreciate you with us tonight.
Speaker 4: It's a great time.
Speaker 3: Hey, guys, I want to tell all of you today
Speaker 3: about a new newsletter that we're launching that encompasses both
Speaker 3: the team House podcast, the eyes On podcast, and the
Speaker 3: high Side News outlet, which I run with on Naylor.
Speaker 3: The newsletter is gonna be once a week. It's gonna
Speaker 3: come into your inbox and you're gonna get the most
Speaker 3: current podcasts on eyes On and the Teamhouse and whatever's
Speaker 3: topical or current on the high Side. So it's another
Speaker 3: way for us to get the information out to you
Speaker 3: as social media algorithms are pretty iffy and you never
Speaker 3: really know.
Speaker 4: What you're gonna get. So this is a once a
Speaker 4: week email.
Speaker 3: It'll slide into your inbox and it will have you
Speaker 3: know the greatest hits of that week.
Speaker 4: It's really good.
Speaker 2: Checking it out.
Speaker 3: The website for it is Teamhouse Podcast, dot kit dot com,
Speaker 3: slash Join, Teamhouse Podcast dot kit dot com slash Join.
Speaker 3: You go there and you enter into your email list
Speaker 3: or you enter your email into the little thing on
Speaker 3: the website and you're good to go.
Speaker 4: And that'll be it. So we really appreciate your support
Speaker 4: and hope you'll consider signing up where the link.
Speaker 3: The link will also be down in the description if
Speaker 3: you're looking for it there
Speaker 7: And that's Teamhouse Podcast, dot Kit, k I, t Kilo India,
Speaker 7: Tango dot com backslash Join